`seal` pushes sealed images as `zstd:chunked` instead of the previous default `gzip`, for faster decompression on install/upgrade -- unconditionally, not opt-in. Partial/delta pulls are NOT claimed: composefs, the backend this estate boots (per docs/decisions.md), has no confirmed chunked-aware partial-pull support upstream as of bootc 1.16.x (containers/storage#2095 still open). A post-push gate -- `skopeo inspect --raw` against the just-pushed manifest -- asserts the top layer's mediaType is `tar+zstd` AND carries the `io.github.containers.zstd-chunked.manifest-checksum` annotation, guarding against skopeo#2627's known behavior of mutating the compression annotation without real chunked TOC data. Driven by `cairn/base#14`. No new input; every consumer picks up the new push format by moving the component pin. Minor bump: new capability, no interface change. Also lands a quay pin-rot cleanup: `chunkah` (base-build-scratch's splitter) and `bootc-image-builder` convert from digest to tag-track, same class as buildah/skopeo in v10.1.1 -- a live digest at audit time doesn't refute the GC risk. `chunkah` tracks its resolved tag (`v0.6.0`); `bootc-image-builder` tracks `latest` by design, matching this repo's own v3.0.4 precedent for the same image (upstream ships no content tag at all). `hadolint` (ghcr.io) and `gitlab-org/cli` (registry.gitlab.com) were audited against the same question and stay digest-pinned: neither registry garbage-collects referenced manifests the way quay does. `renovate.json`'s `templates/*.yml` customManager gained a fourth matchString so it tracks arbitrary CI/CD variable-key pins, not just `image:`/`name:` (issue #7). - `seal`: pushes with `buildah push --compression-format zstd:chunked`; a post-push gate asserts the pushed manifest's top layer is `tar+zstd` with a real chunked TOC annotation, not just a mutated media type (cairn/base#14). - `templates/base-build-scratch.yml` (`CHUNKAH_REF`) and `installer-anaconda-iso/template.yml`/`containers/bib.Containerfile` (`bootc-image-builder`): digest pins converted to tag-track (`v0.6.0`, `latest` respectively); both get `pinDigests: false` in `renovate.json` so Renovate never re-pins a digest onto either. - `renovate.json`: `templates/*.yml` customManager's fourth matchString tracks arbitrary CI/CD variable-key pins (e.g. `CHUNKAH_REF`), not just `image:`/`name:`. - `hadolint` and `gitlab-org/cli` were audited under the same digest-vs-tag question and left digest-pinned: both registries retain referenced manifests, unlike quay. - Consumer pin bumps (base, lodestone) and promote-side idempotency under the new compression format ride the upcoming fleet transaction, not this tag -- `zstd:chunked`'s encoder determinism across pushes of unchanged content is undocumented upstream, so promote's digest-compare fast path may stop firing (an extra `skopeo copy --all`, not a false promotion). - `.gitlab-ci.yml`'s `consumer-change-paths-aligned` job (catalog CI, not shipped to consumers) lands ahead of this tag: enforces example-edge's D3 (an instance consumer's `build_change_paths` anchor must mirror its Containerfile's COPY/ADD sources) across all eight real instance consumers, real PyYAML + Containerfile parsing rather than a grep/awk approximation (issue #5).