mirror-history: wire check/record into _mirror-image.yml #159

Part of #157.

Wire the mirror-history action into the reusable mirror workflow so a digest that was already synchronized is not re-mirrored.

Changes to _mirror-image.yml

• Check step (before mirror-image): resolve the source digest, call mirror-history check. Skip the copy when already-synchronized=true, unless force.
• Gate the existing Mirror image step at the workflow level (if: / a skip input) so the mirror-image action stays single-purpose.
• Record step (after a successful copy, or a force run): call mirror-history record.
• copy_referrers: a recorded digest also suppresses the referrer re-copy (skip); force refreshes referrers on demand.
• Job summary: report skipped (already synchronized) distinctly from up to date and copied.

Preserve all current behaviour (acquisition provenance, multi-arch, concurrency, least-privilege auth). Callers (mirror-*.yml) unchanged — workflow_call signature stays compatible.

Depends on: #158.
Design: docs/architecture/acquire/mirror-history.md.