Cover private digest image validation internals (#7707)

* Initial plan

* test: cover private image validation internals

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Author: Copilot

src/image-resolver.test.ts

@@ -33,6 +33,11 @@ describe('custom runtime image manifest', () => {
     expect(imageResolverExports).not.toHaveProperty('DEFAULT_DOH_PROXY_IMAGE');
   });
 
+  it('keeps digest-pinned image validation internals private', () => {
+    expect(imageResolverExports).not.toHaveProperty('DIGEST_PINNED_IMAGE_PATTERN');
+    expect(imageResolverExports).not.toHaveProperty('isDigestPinnedImageReference');
+  });
+
   it('resolves only the digest-pinned configured image', () => {
     const result = resolveRuntimeImage(
       config({ squid: image('squid') }),