fix: Docker container update detection showing false positives

Fixed an issue where all Docker containers were showing 'click to update'
even when they were up to date. The root cause was comparing the wrong
digest types:

- Previously: Compared ImageID (local config hash) vs registry manifest digest
- Now: Uses RepoDigests from image inspect, which is the actual manifest
  digest that Docker received from the registry when pulling the image

For multi-arch images, the registry returns a manifest list digest, while
Docker stores the platform-specific image config digest locally. These
will never match, causing false positives for all multi-arch images.

Changes:
- Added ImageInspectWithRaw to dockerClient interface
- Added getImageRepoDigest method to extract RepoDigest from image
- Added matchesImageReference helper for Docker Hub naming conventions
- Added tests for matchesImageReference

Fixes #955

internal/dockeragent/test_helpers_test.go

@@ -32,6 +32,7 @@ type fakeDockerClient struct {
 	containerRemoveFn         func(ctx context.Context, id string, opts containertypes.RemoveOptions) error
 	serviceListFn             func(ctx context.Context, opts swarmtypes.ServiceListOptions) ([]swarmtypes.Service, error)
 	taskListFn                func(ctx context.Context, opts swarmtypes.TaskListOptions) ([]swarmtypes.Task, error)
+	imageInspectWithRawFn     func(ctx context.Context, imageID string) (image.InspectResponse, []byte, error)
 	closeFn                   func() error
 }
 
@@ -137,6 +138,14 @@ func (f *fakeDockerClient) TaskList(ctx context.Context, opts swarmtypes.TaskLis
 	return f.taskListFn(ctx, opts)
 }
 
+func (f *fakeDockerClient) ImageInspectWithRaw(ctx context.Context, imageID string) (image.InspectResponse, []byte, error) {
+	if f.imageInspectWithRawFn == nil {
+		// Return empty response with no RepoDigests by default (simulates locally built image)
+		return image.InspectResponse{}, nil, nil
+	}
+	return f.imageInspectWithRawFn(ctx, imageID)
+}
+
 func (f *fakeDockerClient) Close() error {
 	if f.closeFn == nil {
 		return nil