docs: clarify --artifact-type=docker requires registry digest (#834)

* docs: clarify --artifact-type=docker requires registry digest

A customer hit "repo digest unavailable for the image, has it been
pushed to or pulled from a registry?" after kosli attest artifact with
--artifact-type=docker in CI, where the image was built but never
pushed. The constraint that the docker artifact type requires a
registry-resident image was only stated in the error itself.

Add a note to the long descriptions of attest commands (via
fingerprintDesc) and kosli fingerprint, covering the constraint and
pointing at oci and dir as alternatives.

Help-text only; no behaviour change. Auto-generated docs in
kosli-dev/docs will pick this up on the next CLI release.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs: drop dir suggestion from artifact-type=docker note

Source-dir fingerprinting only works as an end-to-end identity if the
runtime side also fingerprints the source dir. Standard Kosli runtime
reporters fingerprint the running image, so suggesting dir as a generic
swap is misleading — the attested and running artifacts would never
link. Push and oci are the safe answers for the typical case.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: AlexKantor87

cmd/kosli/fingerprint.go

@@ -40,6 +40,11 @@ images in registries or "docker" for local docker images.
 Fingerprinting container images can be done using the local docker daemon or the fingerprint can be fetched
 from a remote registry.
 
+Note: ^--artifact-type=docker^ reads the image's repo digest via the local Docker daemon, so
+the image must have been pushed to or pulled from a registry. A freshly built image (just
+^docker build^) does not have a repo digest. For images already in a registry, prefer
+^--artifact-type=oci^ to fetch the digest directly from the registry.
+
 ` + fingerprintDirSynopsis
 
 const fingerprintExamples = `

cmd/kosli/root.go

@@ -42,12 +42,18 @@ const (
 
 	// the following constants are used in the docs/help
 	fingerprintDesc = `
-The artifact fingerprint can be provided directly with the ^--fingerprint^ flag, or 
+The artifact fingerprint can be provided directly with the ^--fingerprint^ flag, or
 calculated based on ^--artifact-type^ flag.
 
 Artifact type can be one of: "file" for files, "dir" for directories, "oci" for container
 images in registries or "docker" for local docker images.
 
+Note: ^--artifact-type=docker^ reads the image's repo digest via the local Docker daemon.
+The image must have been pushed to or pulled from a registry for a repo digest to exist;
+a freshly built image (just ^docker build^) will not have one. If the image is already in
+a registry, prefer ^--artifact-type=oci^, which fetches the digest directly from the
+registry without needing a local Docker daemon.
+
 `
 
 	attestationBindingDesc = `

cmd/kosli/testdata/output/docs/mintlify/artifact.md

@@ -16,12 +16,18 @@ artifact {IMAGE-NAME | FILE-PATH | DIR-PATH} [flags]
 
 Report an artifact creation to a Kosli flow.  
 
-The artifact fingerprint can be provided directly with the `--fingerprint` flag, or 
+The artifact fingerprint can be provided directly with the `--fingerprint` flag, or
 calculated based on `--artifact-type` flag.
 
 Artifact type can be one of: "file" for files, "dir" for directories, "oci" for container
 images in registries or "docker" for local docker images.
 
+Note: `--artifact-type=docker` reads the image's repo digest via the local Docker daemon.
+The image must have been pushed to or pulled from a registry for a repo digest to exist;
+a freshly built image (just `docker build`) will not have one. If the image is already in
+a registry, prefer `--artifact-type=oci`, which fetches the digest directly from the
+registry without needing a local Docker daemon.
+
 
 
 ## Flags