briefs: fold the second accuracy pass (ITMS, skopeo --all, CVO vs OLM)

content/course-VII-supply-chain.md

@@ -37,7 +37,8 @@ limits and egress cost (a hundred nodes should not make a hundred internet pulls
 availability (the fleet boots even when upstream is down or the site is disconnected),
 and control (one place to gate, scan and audit what enters). OpenShift formalises the
 re-route with image mirror rules - and carries a sharp edge: its digest-mirror rules
-rewrite DIGEST pulls only, so a by-tag pull silently skips the mirror. The pinning habit
+rewrite DIGEST pulls only, so a by-tag pull skips them - UNLESS an ImageTagMirrorSet is also
+added (the rule type for tag pulls; corrected 2026-08-17). The pinning habit
 from Move 1 is what makes the mirror actually catch the traffic.
 FIELD NOTE: a mirror can also serve a STALE tag->digest mapping while upstream moved the
 tag. Pin by digest and the whole chain becomes content-addressed - the mirror cannot be
@@ -52,7 +53,8 @@ layers, never all at once.
 The anti-pattern: rebuild the image for each environment ("the prod build"). Every
 rebuild is a different artefact - different digest, different bytes, untested by the
 stages before it. The discipline: build ONCE, then PROMOTE the same digest through
-environments by copying (skopeo copy, registry to registry) - dev proves the exact bytes
+environments by copying (skopeo copy --all --preserve-digests for multi-arch, or the copy takes
+one arch and the promoted digest is not the one that lands) - dev proves the exact bytes
 prod will run. Human-readable tags ride along (a calendar-plus-revision scheme reads well:
 month, year, revision), but the digest is the through-line; promotion never changes it.
 Say it like you mean it: **if the digest changed, it is not a promotion - it is a new