Triage policy check warnings

ops/policy-checks/check_repo.ps1

@@ -253,7 +253,11 @@ function Test-ServicePolicies {
     }
 
     if ($service.Image -match ':[Ll]atest(?:[-@]|$)') {
-      Add-Finding -Findings $Findings -Severity 'warning' -Code 'IMAGE001' -Target $targetBase -Message 'Image uses a latest tag. Prefer a concrete version tag, even when a digest is present.'
+      if (($service.Image -match '@sha256:') -and (Test-IdentityMatch -Service $service -Candidates $Exceptions.allowed_mutable_tag_identities)) {
+        Add-Finding -Findings $Findings -Severity 'info' -Code 'IMAGE002' -Target $targetBase -Message 'Image uses a latest tag but is digest-pinned and documented as an exception.'
+      } else {
+        Add-Finding -Findings $Findings -Severity 'warning' -Code 'IMAGE001' -Target $targetBase -Message 'Image uses a latest tag. Prefer a concrete version tag, even when a digest is present.'
+      }
     }
 
     $isDataService = $false
@@ -362,6 +366,7 @@ $exceptionsRaw = Get-Content -LiteralPath $exceptionsPath -Raw | ConvertFrom-Jso
 $exceptions = @{
   middleware_exempt_identities = @($exceptionsRaw.middleware_exempt_identities)
   allowed_root_identities = @($exceptionsRaw.allowed_root_identities)
+  allowed_mutable_tag_identities = @($exceptionsRaw.allowed_mutable_tag_identities)
   allowed_privileged_identities = @($exceptionsRaw.allowed_privileged_identities)
   allowed_host_network_identities = @($exceptionsRaw.allowed_host_network_identities)
   allowed_host_port_identities = @{}