A release could proceed even if container images (mcpg, firewall, etc.) had no cached SHA pins in actions-lock.json — e.g. after bumping a container version without re-running gh aw compile.

Changes

• release.md — adds a validate_container_pins job that runs after activation and before config. It scans all actions-lock.json files and fails if any container entry is missing a valid digest / pinned_image (both must match sha256:[64 hex]). Error output names the offending images and instructs the releaser to run gh aw compile.
• config job — needs updated to include validate_container_pins, blocking the entire downstream chain (push_tag → defender → sync_actions → release) until the check passes.
• release.lock.yml — regenerated via make recompile.

The validation logic in the new step:

missing_pins=$(jq -r '
  .containers // {} |
  to_entries[] |
  select(
    ((.value.digest // "") | test("^sha256:[a-f0-9]{64}$") | not) or
    ((.value.pinned_image // "") | test("@sha256:[a-f0-9]{64}$") | not)
  ) |
  .key
' "$lock_file")