fix(cri): resolve image reference in RemoveImage (rmi by short tag)

ImageStatus resolves an image reference via resolve_digest (so `crictl inspecti
alpine:latest` finds an image stored under its fully-qualified name), but
RemoveImage passed the raw reference straight to ImageStore::remove, which only
matches an exact key or exact digest — never normalizing a short tag. So
`crictl rmi alpine:latest` failed with 'Image not found' for an image stored as
docker.io/library/alpine:latest, even though inspecti just resolved it.

Resolve the reference to its digest the same way ImageStatus does, then remove
by that digest (dropping every reference to the image — the CRI 'remove the
image' semantic). Falls back to the raw ref for a bare digest/id or an unknown
image, preserving the prior not-found behavior.

Found by running the crictl CRI smoke test on current main (16/18 -> rmi was one
of the 2 failures). clippy -D warnings clean; 237 cri tests pass.

Author: Roy Lin

src/cri/src/image_service.rs

@@ -322,8 +322,20 @@ impl ImageService for BoxImageService {
 
         tracing::info!(image = %image_spec.image, "CRI RemoveImage");
 
+        // Resolve the reference to its digest the same way ImageStatus does, so
+        // `rmi <short-tag>` matches an image stored under its fully-qualified name
+        // (ImageStatus resolved it but RemoveImage previously passed the raw ref to
+        // store.remove, which only exact-matches a key or digest). Removing by the
+        // resolved digest drops every reference to the image — the CRI
+        // "remove the image" semantic. Fall back to the raw ref (a bare digest/id,
+        // or an unknown image) so store.remove still handles it / errors as before.
+        let target = self
+            .resolve_digest(&image_spec.image)
+            .await
+            .unwrap_or_else(|| image_spec.image.clone());
+
         self.image_store
-            .remove(&image_spec.image)
+            .remove(&target)
             .await
             .map_err(box_error_to_status)?;