fix: stop reporting unrelated repos as Docker image provenance

[azaidelson]

Follow-up to aae52c1 (resolve official Docker Hub images to source repo, not build wrapper).

Two independent ways a wrong GitHub repo gets reported as an image's source. Three reviewers shaped this; the first pushed version of this PR was itself wrong and was replaced (history kept for the record).

1. Links cited in passing

Filtering Docker's meta repos out of official-image descriptions promoted whatever link came next — including prose asides. library/ubuntu has no source link, only official-images, repo-info, docs, and this, in a locale example:

[PostgreSQL has a good example of doing so](https://github.com/docker-library/postgres/blob/69bc540.../9.6/Dockerfile#L21-L24)

So on main today, ubuntu:24.04 reports github.com/docker-library/postgres. The failure that bites is a wrong-but-plausible repo whose tags coincidentally match the image tag, which yields a fabricated commit with a confidence score.

Rejected approach (first push): require the image name to appear in the owner or repo. Measured against live Docker Hub, this fixed ubuntu and destroyed six correct answers — the source repo frequently shares no substring with the image (eclipse-temurin → adoptium/containers, r-base → rocker-org/rocker, oraclelinux → oracle/container-images, rockylinux, amazoncorretto, prom/node-exporter). It also promoted worse repos, since it scans for the first related link: library/ros went from osrf/docker_images to ros2/demos, matched only because ros is a substring of ros2.

Shipped approach: accept a link as a source claim on any of three signals — the repo is named after the image, it belongs to the image's own Docker Hub namespace, or it is linked more than once. Descriptions link the source once per supported tag (oracle/container-images appears 18 times); a prose aside appears once.

Over 80 library and namespaced images this matches previous behaviour everywhere except three, all improvements:

image	before	after
ubuntu	docker-library/postgres	none
registry	opencontainers/distribution-spec	distribution/distribution
clickhouse/clickhouse-server	moby/moby	ClickHouse/ClickHouse

This also makes the meta-repo deny list load-bearing rather than cosmetic: docker-library/docs and friends are linked 2-6 times in nearly every official description, so a count-based rule would otherwise select them constantly.

2. Redirects turning guesses into answers

When the description yields nothing, resolution guesses name/name. check_github_repo_exists followed redirects, so GitHub's rename redirects turned wrong guesses into confident answers:

ubuntu/ubuntu  -> ubuntu-xx/ubuntu                 (personal repo)
debian/debian  -> Debian/.github                   (meta repo)
consul/consul  -> consuldemocracy/consuldemocracy  (unrelated project)

This is why ubuntu still reported a repo after fix 1 — the description path correctly gave up, then the guess "succeeded" via a redirect. It now requires the API to answer at exactly the requested path, ignoring case.

Measured cost: of 40 guesses, 5 resolve only via redirect; only nginxinc/nginx-prometheus-exporter (a genuine org rename) is one we lose — it returns nothing instead of nginx/nginx-prometheus-exporter. A rename and a squatted name are structurally identical over the API, so no rule separates them. For a provenance tool, no answer beats a wrong one. This is a separate commit (e40ef06) and can be dropped independently if you disagree with that trade.

Result

$ code-provenance --image ubuntu:24.04
  repo:       -
  status:     repo_not_found          # was: github.com/docker-library/postgres

$ code-provenance --image traefik:v3.6.0
  repo:       github.com/traefik/traefik
  commit:     06db5168c0d9
  status:     resolved / exact

Tests

Python 71 pass, Node 37 pass. New coverage for the namespaced path (never exercised before), repeatedly-linked sources, meta repos linked repeatedly, and redirect rejection. node/src/github.ts had no test file at all — node/src/github.test.ts is new. npm test now builds first, so src/ tests cannot silently go unrun.

Known remaining gaps (unchanged by this PR)

• The -library-image wrapper filter is narrower than wrapper naming in the wild: redis → redis/docker-library-redis, nginx → nginxinc/docker-nginx, mariadb → MariaDB/mariadb-docker still resolve to build wrappers rather than source.
• The link regex terminates the repo capture on ., so repos with a dot in the name can never resolve (WASdev/ci.docker captures as WASdev/ci).