Update Docker-OSX Ventura bootstrap image

[qayshp]

Summary

• replace the unavailable sickcodes/docker-osx:ventura bootstrap image with sickcodes/docker-osx:latest
• set SHORTNAME=ventura so the multi-version image still installs the macOS version used by this guide
• explain that latest is intentionally mutable, link the upstream Ventura example, and record the verification date
• leave the later naked image workflow unchanged

Why

Docker-OSX no longer publishes the ventura image tag used by the setup command. Its current setup flow uses the latest image and selects a macOS release with SHORTNAME.

Decision

Keep latest to match Docker-OSX's maintained Ventura instructions. No digest is pinned because this PR does not have a KVM-tested digest; pinning a registry digest without booting it would imply reproducibility evidence we do not have. The guide now makes the mutable-tag tradeoff explicit and directs readers to the upstream command if it changes.

Validation

• git diff --check origin/master...HEAD passes
• Docker Hub currently serves sickcodes/docker-osx:latest
• Docker Hub currently reports the removed sickcodes/docker-osx:ventura tag as not found
• the SHORTNAME=ventura and latest combination matches Docker-OSX's current Ventura example as of July 27, 2026
• the guide has no remaining docker-osx:ventura reference

Limitation

The exact boot command was not exercised end to end because this machine is not a Linux host with KVM and /dev/kvm. The PR does not claim KVM execution.

Fixes #27

[qayshp]

Self-review: the documented bootstrap now follows upstream, with one reproducibility risk to track.

[qayshp]

Validation update

• git diff --check origin/master...HEAD passes.
• Docker Hub currently returns success for sickcodes/docker-osx:latest.
• The removed sickcodes/docker-osx:ventura tag currently returns not found, reproducing the documentation issue.
• The SHORTNAME=ventura form matches Docker-OSX's current multi-version image instructions.

The exact boot command has not been exercised end to end. That requires a Linux host with KVM and /dev/kvm; this SIP-enabled Mac has neither Docker nor the required KVM host environment.

[qayshp]

Merge-readiness decision: 9e7dca4 keeps upstream's documented latest + SHORTNAME=ventura combination, makes the mutable-tag tradeoff explicit, links the upstream command, and records the verification date. Docker Hub serves latest and reports the removed ventura tag as not found. No digest is presented as tested and no KVM execution is claimed; structural docs checks pass.

[zlshames]

Do we really want to make this locked to latest? I would expect that we should pin it to the latest recommended version, rather than just the latest?