fix: recover deployed image from registry on local miss

Adds an app-aware `fn-verify-app-image` helper that pulls the deployed image
from the configured registry when it is missing locally, gated on
push-on-release being enabled, honoring per-app `registry:login` credentials.
Every in-tree `verify_image` caller migrates to the wrapper and the bare
helper is marked deprecated. `config:set` now forwards the deployed image tag
to `release-and-deploy` so the release path no longer pins recovery on the
unrecoverable `:latest` tag.

plugins/storage/src/subcommands/subcommands.go

@@ -65,7 +65,7 @@ func main() {
 		chown := args.String("chown", "herokuish", "--chown: chown option (herokuish, heroku, paketo, root, false)")
 		args.Parse(os.Args[2:])
 		directory := args.Arg(0)
-		common.LogWarn("storage:ensure-directory is deprecated; use storage:create instead.")
+		common.LogWarn("Deprecated: please use 'storage:create' instead of 'storage:ensure-directory'")
 		err = storage.CommandEnsureDirectory(directory, *chown)
 	case "info":
 		args := flag.NewFlagSet("storage:info", flag.ExitOnError)