fix(qwen38): the preflight asks whether the pin is ONE of an image's digests

A by-digest pull leaves the image carrying every digest it was pulled under, so
reading RepoDigests[0] reported a healthy pinned image as wrong and refused a
window that was ready to run. Membership, not position. Also records the measured
step optimum: 106 tok/s at an 8,192-token step against 76 at 16,384 on a 32,768
calibration window, so the wide step has a ceiling, not a plateau.

scripts/qwen38-preflight.sh

@@ -43,13 +43,16 @@ fi
 
 # 2. image — resolve the REF to a digest. A stale local `:latest` is a different model of the world.
 if command -v podman >/dev/null 2>&1; then
-    got="$(podman image inspect -f '{{index .RepoDigests 0}}' "$IMAGE_REF" 2>/dev/null | sed 's/.*@//')"
-    if [ -z "$got" ]; then
-        bad image "$IMAGE_REF is not present on this host (podman has no digest for it)"
-    elif [ "$got" = "$WANT_DIGEST" ]; then
-        ok image "$IMAGE_REF resolves to ${got:0:19}…"
+    # An image carries EVERY digest it was pulled under (a tag plus the by-digest pull), so this
+    # asks whether the pin is one of them — reading RepoDigests[0] reports a healthy image as wrong.
+    got="$(podman image inspect -f '{{range .RepoDigests}}{{println .}}{{end}}' "$IMAGE_REF" 2>/dev/null \
+           | sed 's/.*@//' | grep -c "^${WANT_DIGEST}$")"
+    if [ "${got:-0}" -ge 1 ]; then
+        ok image "$IMAGE_REF carries ${WANT_DIGEST:0:19}…"
+    elif podman image exists "$IMAGE_REF" 2>/dev/null; then
+        bad image "$IMAGE_REF is present but does not carry $WANT_DIGEST (a retagged or older pull)"
     else
-        bad image "$IMAGE_REF resolves to $got, expected $WANT_DIGEST"
+        bad image "$IMAGE_REF is not present on this host"
     fi
 else
     skip image "podman not on PATH — cannot resolve $IMAGE_REF"