mirror: --only-extra-images pulls nothing without an explicit version constraint

Summary

d8 mirror pull --only-extra-images silently pulls nothing for a module/package unless that module/package is given an explicit version constraint. There is no error — the run looks successful but produces an empty (or extra-image-less) result.

Details

In --only-extra-images mode:

• internal/mirror/modules/modules.go — discoverChannelVersions short-circuits to nil when OnlyExtraImages is set, so no release-channel versions are resolved.
• listTagsIfConstrained returns nil when the module has no version constraint (a bare --include-module foo) or an exact-tag constraint.
• Therefore moduleVersions is empty, and pullExtraImages(ctx, name, versions, ...) → findExtraImages(ctx, name, versions) finds nothing, because extra images are discovered per resolved version.

The packages path behaves the same way.

Impact

d8 mirror pull --only-extra-images (with a default/all filter or a bare --include-module foo) exits 0 having pulled no extra images. To get anything, the user must pass a version constraint, e.g. --include-module foo@^1.0.0. This requirement is not obvious.

Expected

When --only-extra-images is set, require an explicit version constraint on the affected includes (fail validation with a clear message), or clearly document the requirement.

As of main (62132d6a).

Start in internal/mirror/modules/modules.go by tracing discoverChannelVersions, listTagsIfConstrained, and the call from pullExtraImages to findExtraImages. Compare the module and packages paths for --only-extra-images with bare and exact-tag includes. Done means the requirement is either enforced with a clear validation message or documented clearly for affected includes.