`docker/dev-rig/Dockerfile` is `FROM opsdeck:rig-base`, and that image comes
from no registry — `docker/dev-rig/up.sh` builds it out of `docker/Dockerfile`
and tags it locally. Discovery walks the tree rather than reading a list of
paths, deliberately, so it finds the line, resolves the unqualified name
against Docker Hub, and prints

    ? opsdeck rig-base: registry answered HTTP 401

on every run. It never made the run red, and it can never be resolved either.
What it cost is the property the tool is built around: a run that finds
nothing writes nothing, so anything it does print is worth reading. A line
that prints forever is a line that gets skipped, and a real registry outage
prints the same shape.

Nothing in `FROM opsdeck:rig-base` distinguishes a locally built image from a
registry one, so the line has to say so itself:

    # dep-check: local — up.sh builds this, no registry has it
    FROM opsdeck:rig-base

The marker is read above a `FROM` or a `COPY --from=`, and that line then
stops being a declaration at all — not reported, not counted toward
`unwatched`, which would have traded permanent noise for permanent red.

Its own line, never trailing: docker has no inline comments, so
`FROM x  # dep-check: local` would fail the build with "FROM requires either
one or three arguments".

It reaches exactly one instruction — a blank line or any other instruction
ends it, further comment lines do not — because an entry that outlives what it
was written for is the ignore-list failure this form exists to avoid. A
mistyped marker leaves the line watched, which is the safe direction.

`--dry-run` now reports 7 dependencies with nothing unreachable.

Closes #25

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

@@ -116,0 +131,4 @@
+  `FROM x  # dep-check: local` fails the build with
+  `FROM requires either one or three arguments`. It reaches exactly one
+  instruction — a blank line or any other instruction ends it — because an entry
+  that outlives what it was written for is the ignore-list failure this form

@@ -167,0 +178,4 @@
+ *
+ * A comment directly above the line rather than an ignore list somewhere
+ * else, for the same reason an action's tag lives next to its SHA: the next
+ * reader of the Dockerfile sees it, and it cannot outlive the line it was

@@ -184,0 +216,4 @@
+      marked = false;
+      return;
+    }
+    if (/^\s*#/.test(line)) {

@@ -139,0 +218,4 @@
+    ["debian"],
+  );
+
+  // and an instruction that is not a FROM consumes it too

@@ -116,0 +145,4 @@
+  That is the answer to "did my marker land where I meant it". A marker that
+  drifted onto the wrong instruction, or one that an `ARG` slipped in above the
+  `FROM` quietly un-marked, shows up as this line moving or going missing —
+  under `--dry-run` only, where a human is already reading; CI stays silent and

@@ -99,0 +101,4 @@
+  // anywhere, a marker that drifted onto the wrong instruction, or one an
+  // ARG un-marked, could never be noticed from a run. Dry run only: this is
+  // the answer to "did my marker land where I meant it", and CI has nobody
+  // asking.