fix(ci): deploy container images by digest, not mutable tags

[peteroden]

What

Capture GHCR image digest after push and use it for immutable ACR import and ACA deployment.

Why

GHCR→ACR import and ACA deployment used mutable image tags. A compromised GHCR image with the same tag could be deployed without detection.

Changes

• .github/workflows/deploy.yml:
  • Capture digest after docker push via docker inspect
  • Validate digest format (sha256:<64 hex>) before proceeding
  • Pass image_digest to Terraform apply
• infra/variables-apps.tf:
  • New image_digest variable with format validation
• infra/container-apps.tf:
  • ACR import uses @digest as source (immutable pull from GHCR)
  • Trigger changed from image_tag to image_digest
  • acr_image uses tag@digest format (tag for readability, digest for integrity)

Design decisions

• tag@digest format: Valid OCI spec, supported by ACA/containerd. Tag provides human readability in Azure Portal; digest is authoritative.
• Unconditional validation: Workflow fails fast if digest extraction returns garbage.

How to test

1. cd infra && terraform init -backend=false && terraform validate
2. Deploy workflow: verify digest appears in GITHUB_OUTPUT
3. After apply: verify ACR image was imported by digest, ACA container uses digest reference

Review notes

• OWASP review: addressed LOW finding (added validation regex)
• Cross-vendor code review: addressed HIGH finding (added digest extraction error handling)

Closes #299