[sidoruka]

Implements #4656

Behind the new system preference launch.docker.image.pin.digest (off by default), a launched or restarted run resolves the digest its docker image tag points to, stores it as actualDockerImageDigest, and its pod is created with <repo>@sha256:..., keeping the tag in the docker_image annotation. The preference is read only when a run is created, a resume always uses the tag (the pause commits the container under it), and a run's container is found by its name, so switching the preference never affects runs that already exist. The digest is shown at the run's pages in the GUI and by pipe view-runs <id>.

The commits are split by area: API and core, GUI, CLI, docs, and the manual UI test cases (docs/testcases/UI/Run_tools_in_sandbox/4656_digest_pinning, 4656_1 to 4656_7, indexed in GUI_tests.md). The cases follow the live test: the preference default, the digest shown and equal to the version digest, pause and resume keeping the run changes, commit, a run launched before the switch-on, switching off with pinned runs running, and a rerun after the tag moved.

Decided while implementing: a digest that cannot be resolved falls back to the tag, with a warning; a restart resolves the digest again rather than reusing the original one; cluster workers resolve their own digest (inheriting the parent's is not done); the digest is not indexed for the global search.

Test plan

• :api:test, the whole suite, against PostgreSQL 16.4 as in CI: 4133 tests, 0 failures. After the review fixes, the changed test classes (99 tests) and the Spring and DAO tests that launch, restart and archive runs (151 tests) again
• :core:test, :notifier:smtp:test, and checkstyle and PMD of api and core
• client: npm test (267 tests) and npm run lint (no new problems)
• pipe-cli: the new tests/test_view_run_docker_image.py; tests/test_pipe.py, tests/test_storage_operations.py and tests/api fail the same 10 tests as on develop
• Live on a dev sandbox (Kubernetes 1.15.4 on AWS), with the preference off, on, and off again: launch, commit, pause and resume, container size and network limit of runs launched before and after each switch; a run launched after the tag was moved gets the new digest while a running pinned run keeps its own; a pinned run resumes with the tag, from the image its pause saved
• Restart of a spot run, live: blocked by Spot run restart from PodMonitor fails with NullPointerException: no current user #4658 (the restart fails before the launch on develop too)
• The GUI in a browser: the sandbox serves no UI; the CLI was checked against the run payload of the live API
• Two resumes on the sandbox lost their node to the autoscaler after the pod had been created with the tag: Resuming a paused run can lose its node: the autoscaler scales it down before the pod starts #4659, not related to this change

Found while testing: #4657, #4658, #4659.

🤖 Generated with Claude Code

[rodichenko]

f0f1ec3: the GUI check for whether a run has a docker image digest is now the hasDockerImageDigest helper in client/src/components/runs/utilities/docker-image-digest.js. Both Log.js and RunDockerImageDigest use it, so Log.js no longer imports a component from run-details/. Log.js now shows the digest as plain text, like the rows next to it. Nothing changes for the user.

Checks: npm test (269 tests passed) and npm run lint (no new problems).

🤖 Generated with Claude Code

[rodichenko]

GUI: OK