max / alloy

Move the base pins, which the registry had deleted under us Both `FROM` digests 404 on quay.io. Not stale, gone: HEAD on the manifest endpoint returns 404 for each, from any architecture and with the index Accept headers refresh-base-digests.sh itself uses. So the Alloy image has not been buildable from a clean cache on any machine, and fw13 only kept working because the layers were already in its store. That is worse than it sounds given the distribution position. Nothing is published and the stranger builds the image themselves (docs/IMAGE.md), so a dead base pin is not an inconvenience for us, it is the whole install path failing at step one for everyone who does not already have the layers. Found while starting the aarch64 image validation on astra (GO 35bc1716, "do this first, it can invalidate the above"). The first pull failed, which reads as an arm gap and is not one. Moved with build/refresh-base-digests.sh, which is the sanctioned way and proves both new digests are indexes over amd64 and arm64 before writing them. The script's own warning stands: everything rebuilds from scratch, and this is a base image move rather than maintenance. It was made without asking because the alternative was an unbuildable repo, and the old digests cannot be restored -- they are not in the registry to pin.