fix(build): use image content digest, not attested index digest

[nabsei]

What I did

docker compose build (via Bake) recorded BuildKit's top-level containerimage.digest metadata field as the built image's identity, used to decide whether a container needs to be recreated. With provenance attestations enabled (the default since recent Buildx/BuildKit) and the containerd image store, this digest is for the whole attested index (image manifest + attestation manifest), and it changes on every build — even a fully cached one — because the attestation manifest embeds per-build metadata (timestamps, build refs). The image content itself never changes.

This made docker compose up --build recreate containers unnecessarily on every run, even when nothing actually changed.

The fix inspects the built (or already-local) image via the Engine API with manifests=true (API 1.48+ / Engine 28.0+) and picks the digest of the manifest with Kind == "image", ignoring the "attestation" manifest. That digest only reflects the actual image content (config + layers), so it's stable across rebuilds with unchanged content, and still changes correctly when the content does change. I applied the same fix to getImageSummaries (used for already-local images) so both sides of the staleness comparison use the same, consistent digest. Images that only exist in a registry (push / multi-platform builds) aren't locally inspectable, so they keep the Bake-reported digest as before — this only affects the common local build case where the bug was reported.

Verification

I reproduced the bug against a real Docker Desktop engine (containerd snapshotter, default provenance attestations on arm64), confirmed the root cause by inspecting BuildKit's raw Bake metadata and the daemon's manifests=true image inspect response directly, then verified the fix end-to-end:

• Before the fix: docker buildx bake on an unchanged Dockerfile produces a different containerimage.digest/image ID on every run despite CACHED build steps.
• With the fix: two consecutive docker compose up -d --build runs with no changes keep the exact same container (same ID, same creation timestamp) — no unnecessary recreate.
• Sanity check: changing the Dockerfile content still correctly triggers Recreate/Recreated.
• go build ./..., go vet ./..., and golangci-lint run are all clean.
• Full go test ./... passes; the only pre-existing failures (in pkg/watch and pkg/e2e) are environmental/flaky and reproduce identically on unmodified main, unrelated to this change.
• Added unit tests (TestContentDigest, TestGetImageSummariesUsesContentDigestNotAttestedIndexDigest) covering the digest-selection logic directly.

Related issue

Fixes #13636

---

Disclosure: this PR was prepared with the assistance of Claude Code (Anthropic). All investigation, the root-cause diagnosis, the fix, and the verification steps above were done and checked by me; I'm disclosing the tool's involvement for transparency.