Compare full platform tuple in manifest verification, not just arch

architecture and digest live in separate parts of an index descriptor,
so comparing only {arch, digest} can't distinguish a digest attached
to the wrong os/variant within the same architecture. Include os and
variant in the comparison key so the check can't pass on a partial
match.

Signed-off-by: Abrar Shivani <ashivani@nvidia.com>

Author: abrarshivani

.github/workflows/precompiled.yaml

@@ -501,7 +501,7 @@ jobs:
             REMOTE_RAW=$(skopeo inspect --raw --authfile "${REGISTRY_AUTH_FILE}" "docker://${IMAGE}")
 
             if echo "$LOCAL_RAW" | jq -e '.manifests' >/dev/null 2>&1; then
-              JQ_FILTER='[.manifests[] | select(.platform.architecture and .platform.architecture != "unknown") | {arch: .platform.architecture, digest: .digest}] | sort_by(.arch)'
+              JQ_FILTER='[.manifests[] | select(.platform.architecture and .platform.architecture != "unknown") | {os: .platform.os, arch: .platform.architecture, variant: (.platform.variant // null), digest: .digest}] | sort_by(.os, .arch, .variant)'
               LOCAL=$(echo "$LOCAL_RAW" | jq -c "$JQ_FILTER")
               REMOTE=$(echo "$REMOTE_RAW" | jq -c "$JQ_FILTER")
             else