Inspect a remote image's config, digest, and labels without pulling it into a daemon, and pin builds/deploys to the resolved digest, using skopeo.

Documented steps

1. Run `skopeo inspect docker://<registry>/<repo>[:tag]` to fetch and print manifest/config JSON without a full pull. Per docs/skopeo-inspect.1.md the output includes Name, Digest, RepoTags, Created, Labels, Architecture, Os, Layers, LayersData, Env. Example: `skopeo inspect docker://docker.io/fedora`.
2. Use `--format`/`-f` with a Go template to extract one field, e.g. `skopeo inspect docker://docker.io/library/alpine:latest --format "Digest: {{.Digest}}"`, or `skopeo inspect --format '{{ .Env }}' docker://registry.access.redhat.com/ubi8`. `--config` outputs the OCI config instead of the summary: `skopeo inspect --config docker://registry.fedoraproject.org/fedora --format "{{ .Architecture }}"`.
3. Skip listing all repo tags (faster) with `--no-tags`/`-n` ('When true, the RepoTags array will be empty').
4. Use `--raw` for the raw manifest or config bytes; note `--format` is not supported together with `--raw`.
5. For non-default arch/OS entries of a multi-arch image, use the global flags before the subcommand: `skopeo --override-arch arm64 inspect docker://...` (docs/skopeo.1.md).
6. Authenticate as needed: `--creds username[:password]`, `--username`/`--password`, `--no-creds` for anonymous, `--registry-token <bearer>`, or `--authfile <path>` (default ${XDG_RUNTIME_DIR}/containers/auth.json on Linux, managed via `skopeo login`; overridable via REGISTRY_AUTH_FILE).
7. Pin to an immutable digest by reading `.Digest` from the inspect output and referencing the image as `repo@sha256:<digest>` in downstream tooling (buildah/podman/Kubernetes manifests) instead of a mutable tag. Docs: https://github.com/containers/skopeo/blob/main/docs/skopeo-inspect.1.md