resolve-images: abra-independent version resolver; fix release-line over-count

immich pins two images with BOTH a tag and a digest, which makes abra FATA and
abandon the WHOLE recipe. It therefore contributed no version data at all and
silently dropped out of every survey — indistinguishable from 'up to date'. The
standing answer was prose in three skills telling an agent to check registries by
hand. This replaces it with a tool.

resolve-images.py reads the compose files and queries registries itself:
  - Docker Hub, ghcr, and any OCI registry via its own auth challenge (lscr.io
    and dock.mau.dev advertise different realms; assuming ghcr's shape 401'd).
  - tag SHAPES (digits -> '#') so -alpine stays on -alpine and 'latest' is never
    proposed as an upgrade.
  - reports newest_within_major AND newest_same_shape, and refuses to choose:
    immich's postgres tag encodes the pg major plus the vectorchord/pgvectors
    build immich-server expects, so taking the newest breaks the deploy.
  - integrity check: if the CURRENT pin is absent from the listing, the listing
    was truncated and any 'newest' is a guess. ghcr caps out past 40k tags, so
    that falls back to the project's GitHub releases.
  - per-repo cache + backoff + Docker Hub auth: a fleet sweep re-reads nginx,
    redis and postgres many times and was getting 429s reported as 'unresolved'.

21/21 recipes now resolve. It found upgrades abra missed entirely in five:
mumble (abra said 'no new versions'; four patches behind), plausible's
clickhouse, lasuite-drive's collabora, gitea's mariadb, immich's postgres.
plausible's carried four CVEs, three high.

Also fixes a real over-count found while validating that: a fix inside the
numeric window is not a fix on the branch you land on. ClickHouse patched
CVE-2023-48704 in 23.9.6.20 AND 23.10.5.20 — landing on 23.10.4.25 crosses the
23.9 fix but sits below its own line's, so it does NOT have it. A fix named on
the target's own line and above the target is now proof of absence.

70 tests (64 offline + 6 live). keycloak's live expectation moves 7 -> 12 and
mailu's 0 -> 2: both are the release-note source finding real fixes that were
never filed as advisories.

cc-ci-plan/advisory-scan.py

@@ -164,6 +164,21 @@ def _vkey(v: str | None) -> tuple:
     return tuple(out)
 
 
+def _superseded_on_target_line(kt: tuple, cands: list[tuple]) -> bool:
+    """Does a patched version on the TARGET's own release line sit ABOVE the target?
+
+    Projects maintain several branches at once and backport per branch, so "some patched version is
+    inside the numeric window" is not the same as "the version we land on has the fix". ClickHouse
+    fixed CVE-2023-48704 in 23.9.6.20 AND 23.10.5.20; an upgrade landing on 23.10.4.25 crosses the
+    23.9 fix numerically but is still BELOW its own line's fix, so it does NOT have it. When the
+    advisory names a fix on the target's own line and the target is older than it, that is proof of
+    absence and outranks any other candidate."""
+    if len(kt) < 2:
+        return False
+    line = kt[:2]
+    return any(c[:2] == line and c > kt for c in cands if len(c) >= 2)
+
+
 def _within(kf: tuple, kt: tuple, c: tuple) -> bool:
     """Is patched-version `c` inside the window (kf, kt] — exclusive lower, inclusive upper?
 
@@ -665,6 +680,10 @@ def scan(recipe: str, v_from: str | None, v_to: str | None, registry_dir: str,
                     continue
                 patched = e.get("patched") or ""
                 cands = [_vkey(t) for t in re.findall(r"\d+(?:\.\d+)*", patched)]
+                if kf and kt and _superseded_on_target_line(kt, cands):
+                    # The target's own line got the fix LATER than the target: not fixed here.
+                    e.setdefault("classification", "outside-window")
+                    continue
                 if kf and kt and any(_within(kf, kt, c) for c in cands):
                     got.add(cve)
                 elif not patched or PLACEHOLDER_RE.search(patched):