fix(e2e): pin rustfs/rustfs to a digest instead of :latest

:latest is a floating tag — an upstream push could silently change what CI and
the harness run against, with no diff to review. Pinned both references
(compose.test.yaml's stable test store, run.sh's native-podman harness store) to
the digest :latest currently resolves to (1.0.0-beta.11, confirmed via Docker
Hub's tags API and a verified podman pull), with a comment noting the version and
where to look up a new digest when bumping deliberately.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0155z4WEezE9gofR1zkHbMxK
Signed-off-by: David Bensoussan <d.bensoussan@proton.me>

Author: Minipada

tools/e2e/compose.test.yaml

@@ -27,6 +27,9 @@ services:
       retries: 30
 
   rustfs:
-    image: docker.io/rustfs/rustfs:latest
+    # rustfs/rustfs 1.0.0-beta.11 — pinned by digest, not :latest, so an upstream
+    # image change can't silently alter CI/local test behavior. Bump deliberately:
+    # check https://hub.docker.com/r/rustfs/rustfs/tags for the new digest.
+    image: docker.io/rustfs/rustfs@sha256:84ce557a0245a06a9aae5516f55ee0f007fca78d41df356f419306fdc0cb168c
     container_name: dc_rustfs_test
     network_mode: host

tools/e2e/scripts/run.sh

@@ -127,9 +127,12 @@ podman run -d --network host --name "$PG_C" \
   -v dc_e2e_pgdata:/var/lib/postgresql/data \
   -v "$E2E_DIR/sql/init.sql:/docker-entrypoint-initdb.d/init.sql:ro" \
   docker.io/library/postgres:13 >/dev/null
+# rustfs/rustfs 1.0.0-beta.11 — pinned by digest, not :latest, so an upstream image
+# change can't silently alter harness behavior. Bump deliberately: check
+# https://hub.docker.com/r/rustfs/rustfs/tags for the new digest.
 podman run -d --network host --name "$RUSTFS_C" \
   -v dc_e2e_rustfs_data:/data \
-  docker.io/rustfs/rustfs:latest >/dev/null
+  docker.io/rustfs/rustfs@sha256:84ce557a0245a06a9aae5516f55ee0f007fca78d41df356f419306fdc0cb168c >/dev/null
 
 timeout 60 bash -c "until podman exec $PG_C pg_isready -U dc >/dev/null 2>&1; do sleep 1; done" \
   || { log "Postgres never became ready"; exit 1; }