fix(image-updates): explain persistent digest rebuilds after update (#1784)

* fix(image-updates): explain persistent digest rebuilds after update

When an update completes but a same-tag digest rebuild is still detected,
the generic "update still detected" warning told operators nothing about
why. The digest comparison already knows the remaining updates are
digest-only (no higher tag), so recheckStack now returns a targeted
warning naming the two daemon-side causes: a registry mirror or cache
serving stale content, or a container still pinned to the previous image.

The digest-rebuild badge surfaces (Anatomy banner, Fleet cards, mobile)
now carry a tooltip with the same explanation, and the post-update
warning is added to the pre-update refresh sanitization set.

* fix(image-updates): surface digest warnings on editor and mobile paths

Editor Update discarded recheckWarning, digest hints were hover-only, and
service-scoped rechecks blamed the daemon when only sibling services remained stale.

frontend/src/lib/updatePreviewActionability.ts

@@ -3,6 +3,11 @@
  * Tag-only availability is advisory: Compose pull does not rewrite pins.
  */
 
+/** Tooltip for digest-rebuild surfaces: what the badge means, and why an
+ *  update may not clear it (daemon-side causes behind a persistent badge). */
+export const DIGEST_REBUILD_HINT =
+  'Same tag, newer content. If Update does not clear this, your Docker daemon may be pulling through a mirror or the container may still be on the previous image. Check your daemon configuration.';
+
 export interface UpdatePreviewActionImage {
   service?: string;
   has_update?: boolean;