fix(auto-sync): mirror trusted manifest acquisition into research repairs

[thxCode]

What

• Field-level failure detail: when a candidate manifest differs from the trusted registry acquisition, the group reason now names each mismatched field with both values (platform_digest: claimed sha256:…, acquired sha256:…) instead of a bare sentence.
• Repairable mirror check: the research stage now mirrors validation's registry acquisition in proposal finalization (_check_manifests), where a bounded repair session can still correct the reply. The error carries the acquired values, so the correction is transcription and needs no network access.
• Recording rule on every surface: the proposal prompt, its output contract, the runner-release-sync skill, and release-automation.md now state that a tag digest resolving to a manifest list / OCI index means platform_digest is the row platform's child digest, never the list digest (only a single-platform image manifest keeps them equal).
• Recipe guidance: the cann/vllm upgrade guide records that Ascend base tags publish multi-platform manifest lists — platform rows come from list children, and matrix platforms are never narrowed without listing the tag's children as evidence.

Why

Auto-sync run 38328179891 failed validation: the cann/vllm proposal recorded every base tag's manifest-list digest as platform_digest (37c73f9e… etc.) and concluded the tags are linux/amd64-only, dropping arm64 from the matrix. All four v0.30.0rc1* tags actually publish amd64+arm64 children (verified with crane: amd64 children 05d4352c…, 72da828d…, fc3e3d52…, 58b68393…, plus arm64 children in every list). Validation's trusted acquisition caught the mismatch correctly — this PR makes that failure diagnosable at a glance and repairable before validation.

Tests

• Extended test_fabricated_manifest_rejected_before_write: the failed group's reason names platform_digest and carries both the fabricated and the acquired digest.
• New test_research_manifest_mismatch_repair_transcribes_acquired_values: a fabricated platform_digest is rejected during proposal finalization, the repair prompt carries the acquired values, and the corrected proposal completes the research stage.
• Full tests/auto_sync suite: 827 passed, 17 skipped. Pre-commit hooks and mkdocs build --strict pass.

[gemini-code-assist]

Code Review

This pull request introduces stricter validation and documentation for image manifest fields (such as digest, platform_digest, and config_platform) acquired from crane output, ensuring they correctly map to multi-platform manifest lists or OCI indices. It refactors tools/auto_sync/run.py to extract manifest validation into a reusable _require_acquired_manifest helper, which is now also executed during the finalization phase via _check_manifests. Feedback on the changes suggests using defensive dictionary access in _require_acquired_manifest to prevent potential KeyError or TypeError crashes when the manifest field or its keys are missing or null.

[thxCode]

Review triage summary

Feedback accounted for: 1 review (Gemini Code Assist, COMMENTED), 1 inline thread, 0 issue comments, no suppressed comments in the review body.

Comment	Location	Verdict	Outcome
Use defensive .get() when reading row["manifest"][key] in _require_acquired_manifest	tools/auto_sync/run.py	False positive	Replied on the thread with the reasoning; left open for the reviewer, no code change

Reasoning in brief: the five-key manifest shape of a ready row is an enforced invariant of validate_proposal (exact key set, digest pattern, platform equality), both call sites are gated on group["status"] == "ready", and _bind_discovery can only downgrade. The subscript is a total access; a defensive read would mask a validation-layer invariant violation as a data mismatch. CI is green and the branch is unchanged.