fix: allow first-party store service subdomains and registry images

Two manifest validation bugs blocked all store service installs:

1. service_store_manager.RESERVED_SUBDOMAINS included 'mail', which
   prevented the email service from using its required subdomain.
   Removed mail/calendar/files/webmail — they belong to official PIC
   store services and must be claimable by them.

2. manifest_validator required @sha256 digest pins on ALL images,
   including first-party git.pic.ngo/roof/* images that the PIC team
   builds and controls. service_store_manager._validate_manifest already
   only warned for first-party images; the secondary validator was
   stricter than intended, causing a hard reject on :latest tags.
   Aligned to warn-not-reject for first-party; malformed digests (when
   provided) are still a hard error.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/service_store_manager.py

@@ -58,8 +58,10 @@ FORBIDDEN_MOUNTS = frozenset([
     '/', '/etc', '/var', '/proc', '/sys', '/dev', '/app', '/run', '/boot',
 ])
 RESERVED_SUBDOMAINS = frozenset([
-    'api', 'webui', 'admin', 'www', 'mail', 'ns1', 'ns2',
+    'api', 'webui', 'admin', 'www', 'ns1', 'ns2',
     'git', 'registry', 'install',
+    # mail, calendar, files, webmail are intentionally absent:
+    # they are claimed by official PIC store services.
 ])
 ENV_VALUE_RE = re.compile(r'^[A-Za-z0-9._@:/+\-= ]*$')
 SUBDOMAIN_RE  = re.compile(r'^[a-z][a-z0-9-]{0,30}$')