Public Access
Implements: DEVX-165 REQ-1..3 - create_dependency_pr gains --manifest/--verify-container/--source-ref: resolves the producer image's OCI digest via the packages API before opening the PR, then writes structured manifest fields (version/git_ref/image_tag/image_digest/updated_at) in the PR branch - clean_images gains --protect: pinned versions survive --keep trimming so a manifest-referenced digest can't be garbage-collected - regression tests for digest resolution, manifest helpers, verify ordering, and protect filtering