Closes issue #137 (Metal Gear's feedback, 2026-10-11): metalgear issue #289 landed a pipeline pinning image 9b16895c… that neither the hub nor a runner held, and run issue #178 queued until I pushed it.
A run whose jobs pin an image held by neither the hub nor any runner sets a failing pipeline/images check on its state: neither the hub nor a runner holds image 9b16895c8bee: send it with flow rootfs push HASH. A proposal built on that state shows it before it lands; a later run of the state turns the check to passed once the image is held. To avoid false alarms, it says nothing unless some runner is known and every runner reports what it holds (both of ours do), and nothing at all when every image is held.
Test: a_pipeline_pinning_an_image_nobody_holds_fails_a_check. Hub gate green (171 tests with it). Bookmark is main's heads (d7b9a629) plus this change.