make backup uses an unpinned alpine image that evades both CI pinning checks #65

Makefile:264 runs alpine with no tag and no digest:

docker run --rm -v $(STACK)_$$v:/data -v "$(PWD)/backups:/backup" \
	alpine tar czf "/backup/$$v.tar.gz" -C /data .

This is the only unpinned image reference in the repository, and it evades both
CI checks that exist to prevent exactly this:

• ci.yml:94-104 greps for the literal string :latest. A bare alpine has no
  tag to match.
• ci.yml:108-117 asserts every image carries @sha256:, but only reads
  image: lines in compose.yaml.

So the README's claim that "every image carries both a tag and a sha256:
digest, so a moved tag cannot change what deploys" is true of the stack and not
of the tooling that backs it up.

Two things to fix: pin the reference (scripts/image-for.sh is the established
way to keep versions in one place), and widen the CI check so a shell recipe
cannot introduce another one.

Found while verifying #12.