fix(backup): reject cross-repository image pin - #140

Problem

A PostgreSQL 18 service protected before v2026.8.21 can retain the official postgres@sha256:... pin after v2026.8.21 changes the declared image to ghcr.io/labstack/onebox-postgres:18.

Re-running backup enable while the service is still protected selected the old runtime digest but recorded it beside the newly declared managed-image reference. Once that inconsistent pair existed, a later disable/apply/enable cycle could reuse the official digest and extensions remained blocked as pinned before extension support.

Reproduction

1. Protect a PostgreSQL 18 service using a pre-v2026.8.21 Onebox release, recording postgres@sha256:... with reference postgres:18.
2. Upgrade Onebox to v2026.8.21.
3. Re-run backup enable while the service is still protected and no extensions are declared.
4. Observe the lifecycle record pair the official digest with ghcr.io/labstack/onebox-postgres:18.
5. Disable backup, reconcile the service, and re-enable backup.
6. Add features.extensions.vectorscale: {} and apply the service.
7. Observe that the stale official pin is retained and extension enablement is blocked.

Fix

• Reuse a recorded pin only when its repository matches the reference that produced it.
• Resolve the declared image before reusing a runtime digest when the repository changed.
• Reject a registry digest that does not belong to the resolved image repository.
• Cover both prevention of a new inconsistent pair and repair of an existing one.

No lifecycle schema or documentation change is required.

Closes #139