fix(ci): verify staged image config on classic store

scripts/security/runtime_image_mirror_controller.py

@@ -603,7 +603,7 @@ def _registry_descriptor(image_ref: str) -> RegistryDescriptor | None:
     )
 
 
-def _local_platform_digest(image_ref: str, platform: str) -> str:
+def _local_platform_config_digest(image_ref: str, platform: str) -> str:
     output = _run(
         [
             "docker",
@@ -611,17 +611,13 @@ def _local_platform_digest(image_ref: str, platform: str) -> str:
             "inspect",
             "--platform",
             platform,
-            "--format={{json .Descriptor}}",
+            "--format={{.Id}}",
             image_ref,
         ]
     ).stdout
-    try:
-        descriptor = json.loads(output or "{}")
-    except json.JSONDecodeError as exc:
-        raise ControllerError("local_platform_descriptor_invalid") from exc
-    if not isinstance(descriptor, dict):
-        raise ControllerError("local_platform_descriptor_invalid")
-    return _require_digest(descriptor.get("digest"), "local_platform_digest")
+    return _require_digest(
+        (output or "").strip(), "local_platform_config_digest"
+    )
 
 
 def _local_image_present(image_ref: str) -> bool:
@@ -811,10 +807,12 @@ def stage_images(
                             quiet=True,
                         )
                         if (
-                            _local_platform_digest(source_ref, policy.platform)
-                            != image.platform_digest
+                            _local_platform_config_digest(
+                                source_ref, policy.platform
+                            )
+                            != source_config_digest
                         ):
-                            raise ControllerError("local_image_platform_digest_mismatch")
+                            raise ControllerError("local_image_config_digest_mismatch")
                         _run(
                             ["docker", "tag", source_ref, image.push_ref],
                             quiet=True,