fix: make update work for single-arch images and fail on a missed IMAGES block

[sentry-junior]

Fixes three problems in main.py found during the docs refresh (#39).

• update failed with HTTP 400 on single-arch images (for example checkr/flagr:latest). For a single manifest, the script fetches the config blob. Docker Hub redirects that blob to object storage, and urllib forwards the registry Authorization header across the redirect. The storage backend rejects a request that carries two kinds of auth. The bearer token is now added with add_unredirected_header, so it only goes to the registry. Multi-arch images and sync never hit the redirect, so their behavior is unchanged.
• 'arm64/v8' in ARCHS could never match. _digests returns only the architecture field, never architecture/variant, so arm64 images were already selected by 'arm64'. The dead entry is removed. Selected digests stay the same.
• update silently did nothing if the IMAGES regex missed. If the block's layout changed, re.sub matched nothing and the script still exited 0. It now uses re.subn and exits with an error unless exactly one block is replaced.

This also removes the manual workaround for the 400 error from README.md, and changes the AGENTS.md invariant to say a missed regex now makes update exit with an error. Both lines were added in #39.

update --dry-run now finishes for every image in the list. The only digest changes it shows are for moving tags such as postgres:14, and this PR doesn't commit them. sync --dry-run output is identical before and after the change.

via @joshuarli.

--

View Junior Session [Sentry]