False update report when manifest list changes for other architectures #316

Dockcheck reports an update whenever the manifest-list digest of the running tag moves, even when nothing changed for this host's architecture.

Repro (amd64 host, traefik:v3.7.16):

• local RepoDigests: traefik@sha256:c8a121e4... (pull-time list)
• remote list digest now: sha256:1336e85a... -> mismatch -> reported as update
• remote amd64 child: sha256:abb2b9c1..., identical to pull time; local and remote RootFS diff_ids match exactly
• docker compose pull does nothing; other tools report current

Root cause: check_image compares regctl image digest --list against the local RepoDigests. The list moves when any architecture rebuilds or metadata is attached, so a mismatch does not always mean this host can pull anything new.

Fix approach (PR to follow): on list mismatch, compare the local image's layer diff_ids against regctl image inspect --platform <local os/arch>, and only report an update on a real difference. Fails open to the current behaviour when the lookup is impossible.