The digest-drift refusal only said the digest no longer matched, which
left no way to tell a genuine plan/image drift from a comparison bug
(#1666 shipped refusals on every classic-overlay2 host for exactly that
reason, and the report had to correlate image stores to get close).
Include the planned digest plus the local image id and repo digest in
the refusal so the action record itself carries the evidence.
Contract-Neutral: agent preflight refusal message detail only; no payload or schema change, error stays within the existing 1024-byte bounded field
rcourtman
022316fca6