Function resolve_boot_image_match 

fn resolve_boot_image_match(
    mismatch: UKIDigestMismatch,
    candidate: &UkiComposefsCandidate,
    find_matching_result: Result<BootImageMatch<Sha512HashValue>>,
) -> Result<(FormatVersion, Sha512HashValue)>

Interprets the result of searching for a boot image whose digest matches expected (see [composefs_oci::find_matching_boot_image]): uses the matching mode’s digest if one was found, or fails with an error listing every combination tried if not.

Factored out from ensure_correct_composefs_digest purely so this decision logic can be unit tested without a real repo or UKI fixture.