fix(marketplace): a tapped repository follows a mutable tag, so connect should pin a digest #4979

Summary

Connected repository is followed by tag, not pinned.

• cozypkg tap rejects digest references: "digest references are not supported by tap yet" (tap.go L82-L83). Without tag it uses latest (L98-L100).
• buildTapOCIRepository sets Reference{Tag} only, interval of 5 minutes and no verify (L121-L148). Cluster follows whatever tag points to, and connecting never checks a signature.
• Connecting again through API replaces whole spec of existing OCIRepository (rest.go L263), so spec.verify added by hand is dropped. CLI path applies objects with server-side apply under field owner cozypkg (tap.go L334), so field that another manager set and applied object doesn't contain, like spec.verify, should survive there. I read that, did not run it. The two paths behave differently.
• Platform pins itself by digest, installer writes platformSourceRef = "digest=<sha>" into its values (installer Makefile L46-L62). For third-party content cluster does the opposite.

Impact

Whoever controls the tag controls what runs in cluster, within 5 minutes of moving it. New revision gives new ExternalArtifact content, and HelmReleases of existing tenant application instances are built from it, so moved tag reaches running applications. That last step I infer from data flow, did not run it.

Suggested fix

1. Accept @sha256:... references in CLI and API.
2. When tag is given, resolve it to digest at connect time and store ref.digest on OCIRepository. Tag stays informational, moving the pin is explicit action (connecting again with new tag resolves again).
3. Allow spec.verify (keyless cosign identity) in connect request and keep it on repeated connect: merge instead of replacing spec in rest.go.
4. When package index exists, its entries should store digest as well as tag.

Acceptance

• Connecting oci://host/org/repo:v1 produces OCIRepository with ref.digest set and no tag following.
• Moving v1 upstream changes nothing in cluster.
• Repeated connect through API keeps spec.verify set earlier.
• cozypkg tap oci://host/org/repo@sha256:... works.