ci: take one image id when an image carries several tags [CI]

Identical restore images accumulate one tag per commit, and buildah images <name> prints a row per tag, so the single-id check in build-linux-agent.sh failed for every commit after the first. moshiro_image_id returns one id and a test covers the multi-tag case.

scripts/test-linux-agent-build.py

@@ -129,6 +129,25 @@ esac
                         self.assertEqual((base / 'output/moshiro-agent').read_bytes(), b'agent')
                         self.assertEqual((base / 'output/fleet-enroll').read_bytes(), b'enroll')
 
+    def test_an_image_with_several_tags_still_has_one_id(self):
+        # buildah images <name> prints one row per tag of the image; identical restore images accumulate one tag per commit
+        with tempfile.TemporaryDirectory() as directory:
+            base = Path(directory)
+            buildah = base / 'buildah'
+            buildah.write_text('''#!/usr/bin/env bash
+case "$1" in
+  images) shift; [[ "${*: -1}" == localhost/missing:x ]] && exit 0
+          for i in 1 2 3; do echo sha256:030789f05eac3bdb5ac9869725828897bbe39ac56d6274ccf31483e1b01f81ac; done ;;
+esac
+''')
+            buildah.chmod(0o755)
+            env = dict(os.environ, PATH=str(base) + ':' + os.environ['PATH'])
+            def lookup(name):
+                return subprocess.run(['bash', '-c', f'set -euo pipefail; source "{ROOT}/ci/buildah-env.sh"; moshiro_image_id {name}'],
+                                      env=env, check=True, capture_output=True, text=True).stdout
+            self.assertEqual(lookup('localhost/found:x'), 'sha256:030789f05eac3bdb5ac9869725828897bbe39ac56d6274ccf31483e1b01f81ac\n')
+            self.assertEqual(lookup('localhost/missing:x'), '')
+
     def test_cache_cleanup_never_fails_the_step_that_called_it(self):
         # 清理在调用方持锁之后才做，依赖已经还原或构建好了：它失败（比如 buildah unshare 报 memfd_create）只能是警告。
         for script in ('ci/restore-linux-dependencies.sh', 'ci/build-linux-agent.sh'):