Image-to-block catalog authority

A Docker or Compose image becomes a Stackie block only when the owning block declares that image under mocker.images. Mutable Docker tag aliases, image basenames, labels, commands, and bind destinations are not block authority.

Runtime mappings additionally project an immutable fingerprint covering the resolved block version, canonical image alias, code mount, default command, executable allow-list, and sandbox policy. Mocker carries that evidence in a Bridge workload request; Stackied reproduces it before admission.