podvm: fail loud when oras resolve returns empty digest

pull_agent_artifact and pull_gc_artifact in
src/cloud-api-adaptor/podvm/Makefile.inc both call `oras resolve
$OCI_IMAGE:$tag` and capture the result in OCI_DIGEST via make's
$(shell) function. When the registry does not have the requested tag
(for example, when versions.yaml pins a GUEST_COMPONENTS_REF or
KATA_REF that does not have a corresponding published `<sha>-<arch>`
or `<sha>-<tee>_<arch>` artifact), `oras resolve` exits non-zero and
prints nothing to stdout. make captures the empty stdout into
OCI_DIGEST, then constructs `OCI_REF := $(OCI_IMAGE)@` (trailing @ with
no digest), and the downstream `oras pull` either fails opaquely or --
depending on local cache state -- pulls a stale layer from a previous
successful build at a different commit. The resulting PodVM image then
contains guest-components or kata-agent binaries that do not match the
SHAs declared in versions.yaml, with no warning at build time.

This is real. It was the underlying cause of multi-day diagnosis effort
when a PodVM AMI built from CAA v0.20.0 contained an attestation-agent
binary that spoke an older wire protocol than the commit pinned in
versions.yaml shipped, leading to KBS-side `RcarAuthFailed: deserialize
Request - missing field 'version'` rejections. The AMI build succeeded
silently; the failure surfaced 1+ hours later at attestation handshake
time, in a separate component (Trustee).

This change adds a single guard between `oras resolve` and the
subsequent `OCI_REF` construction: the shell output is wrapped in
$(strip ...) (defensive against whitespace), and if OCI_DIGEST is
empty afterwards, make's $(error) function aborts the build
immediately with a message naming the missing image:tag and pointing
at the versions.yaml field to investigate. oras's own stderr is left
visible (no `2>/dev/null` redirection) so users see the underlying
network / auth / 404 details alongside the make-level abort message.

Behavior change: builds that previously produced a stale-binary PodVM
image now fail at the make level with a clear error. Builds whose
versions.yaml pins resolve correctly are unchanged. No CI workflow,
script, or other consumer of this Makefile.inc relies on the silent-
fallback behavior.

A follow-up could add a CI workflow that pre-validates all
versions.yaml::oci.*.reference SHAs resolve in their registries before
a release tag is cut, but that is out of scope for this minimal-diff
fix.

Signed-off-by: Abhishek Agrawal <abhishek.yours4@gmail.com>

Author: Agrek11

src/cloud-api-adaptor/podvm/Makefile.inc

@@ -100,7 +100,8 @@ PAUSE_BUNDLE  ?= pause_bundle
 define pull_agent_artifact
 	$(eval $(call generate_tag,tag,$(KATA_REF),$(ARCH)))
 	$(eval OCI_IMAGE := $(KATA_REGISTRY)/agent)
-	$(eval OCI_DIGEST := $(shell oras resolve $(OCI_IMAGE):${tag}))
+	$(eval OCI_DIGEST := $(strip $(shell oras resolve $(OCI_IMAGE):${tag})))
+	$(if $(OCI_DIGEST),,$(error oras resolve returned empty digest for $(OCI_IMAGE):${tag}. The tag is missing from the registry; check KATA_REF=$(KATA_REF) in versions.yaml against published tags at $(KATA_REGISTRY). Failing the build instead of silently pulling a stale layer.))
 	$(eval OCI_REF := $(OCI_IMAGE)@$(OCI_DIGEST))
 	$(if $(filter yes,$(VERIFY_PROVENANCE)),$(ROOT_DIR)hack/verify-provenance.sh \
 		-a $(OCI_REF) \
@@ -114,7 +115,8 @@ endef
 define pull_gc_artifact
 	$(eval $(call generate_tag,tag,$(GUEST_COMPONENTS_REF),$(2)))
 	$(eval OCI_IMAGE := $(GUEST_COMPONENTS_REGISTRY)/$(1))
-	$(eval OCI_DIGEST := $(shell oras resolve $(OCI_IMAGE):${tag}))
+	$(eval OCI_DIGEST := $(strip $(shell oras resolve $(OCI_IMAGE):${tag})))
+	$(if $(OCI_DIGEST),,$(error oras resolve returned empty digest for $(OCI_IMAGE):${tag}. The tag is missing from the registry; check GUEST_COMPONENTS_REF=$(GUEST_COMPONENTS_REF) in versions.yaml against published tags at $(GUEST_COMPONENTS_REGISTRY). Failing the build instead of silently pulling a stale layer.))
 	$(eval OCI_REF := $(OCI_IMAGE)@$(OCI_DIGEST))
 	$(if $(filter yes,$(VERIFY_PROVENANCE)),$(ROOT_DIR)hack/verify-provenance.sh \
 		-a $(OCI_REF) \