build(ci): emit a single digest line for z2m-seed

Review point on #442: kaniko writes one line per --destination to
--image-name-with-digest-file, so with both :$TAG and :latest the file
holds two entries carrying the same digest, and "PIN THIS:" would print
two near-identical lines for whoever does step 2 to choose between.

Rather than just comment on the ambiguity, remove it: reduce to the bare
digest, dedupe, and print one unambiguous copy-pasteable reference. The
multi-line behaviour is documented inline so a future edit does not
reintroduce it.

Verified the reduction against a two-line fixture matching kaniko's
format:

  gitea.renner.uno/gitea_admin/z2m-seed:2026-07-30@sha256:abc123
  gitea.renner.uno/gitea_admin/z2m-seed:latest@sha256:abc123
  -> PIN THIS: gitea.renner.uno/gitea_admin/z2m-seed@sha256:abc123

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.woodpecker/build-ci-images.yml

@@ -163,4 +163,10 @@ steps:
       # Print the digest-pinned reference so the follow-up commit that pins the
       # Deployment can copy it straight from this build log, with no separate
       # registry query.
-      - echo "PIN THIS:" && cat /kaniko/z2m-seed.digest
+      #
+      # kaniko writes ONE LINE PER --destination to that file, so it holds two
+      # entries (:$TAG and :latest) carrying the same digest. Reduce to the bare
+      # digest and dedupe, so exactly one unambiguous line is emitted rather than
+      # two near-identical ones for whoever does step 2 to choose between.
+      - DIGEST=$(cut -d@ -f2 /kaniko/z2m-seed.digest | sort -u | head -1)
+      - echo "PIN THIS: gitea.renner.uno/gitea_admin/z2m-seed@$DIGEST"