Add 'sha256:' prefix to imageID checksum for GetLocalImage

[adamacosta]

Description

Fix neuvector/neuvector#2508

The containerd /images/get API does not accept bare checksums without a prepended algorithm identifier for the image ID. The moby client's ImageSave() call fails for Docker >=29.0, which now uses the containerd image store (see https://docs.docker.com/engine/storage/containerd/) instead of the classic storage drivers.

This duplicates #587 and @clbiggs deserves credit, but a change was requested three weeks ago without a response, so I'm duplicating and implementing the change request.

Test

Build this locally:

GITHUB_REPOSITORY_OWNER=neuvector bash scripts/ghcr-vulndb-artifact.sh download \
  cvedb \
  cvedb.regular \
  data/cvedb.regular \
  4.302

make build-image

Re-tag some image to force local scan:

docker pull nginx:1.31
docker tag nginx:1.31 local/nginx:1.31

Scan it:

docker run --name neuvector.scanner --rm \
  -e SCANNER_REPOSITORY=local/nginx \
  -e SCANNER_TAG=1.31 \
  -e SCANNER_ON_DEMAND=true \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v /var/neuvector:/var/neuvector \
  neuvector/scanner:dev

This should work and produce a result. For example:

$ jq -r '.report.vulnerabilities[] | .name' /var/neuvector/scan_result.json | wc -l
333
$ jq -r '.report.vulnerabilities[] | .name' /var/neuvector/scan_result.json | tail -n 10
CVE-2026-3184
CVE-2026-3184
CVE-2026-3184
CVE-2026-3184
CVE-2026-3184
CVE-2026-3184
CVE-2026-3184
CVE-2026-3184
CVE-2026-3184
CVE-2026-27171

Before it would fail and fall back to attempting a pull of the remote image (re-tagging to create a repo name that doesn't exist remotely prevents that from working). If you turned on debug logging, you'd have seen:

2026-10-11T16:20:45.493|ERRO|SCT|container.(*dockerDriver).GetImageFile: Failed to get image - error=Error response from daemon: invalid repository name (abe47724e466aeab9a345d8e46a221c2fa8953c7848bb4a3bd9976a7199f8cf2), cannot specify 64-byte hexadecimal strings
2026-10-11T16:20:45.493|ERRO|SCT|cvetools.(*ScanTools).LoadLocalImage: Failed to get image - error=Error response from daemon: invalid repository name (abe47724e466aeab9a345d8e46a221c2fa8953c7848bb4a3bd9976a7199f8cf2), cannot specify 64-byte hexadecimal strings

Indicating the issue that the containerd socket doesn't accept 64-byte hexadecimal strings without a prefix.

Additional Information

Tradeoff

This hard-codes 'sha256:' as the prefix, which is not future proof. See https://github.com/opencontainers/image-spec/blob/main/descriptor.md\#registered-algorithms, which states compliant implementations of OCI SHOULD use SHA-256, but there are other registered algorithms we may see used in the future.

Potential improvement

[pohanhuang]

@adamacosta can you fix the linter issue?

[pohanhuang]

Thanks @adamacosta
Can you help squash 3 commits to 1 in the PR? then create the commits message fix: normalize Docker image IDs before export

[pohanhuang]

Thanks @adamacosta for the contribution!