security watch: the RUNTIME line names the zstd decoder in words, not the module repr (R-1327)

scripts/image_runtime.py

@@ -138,18 +138,24 @@ def zstandard_module(fetch=None, wheels=None, cache=None, try_import=True):
 
 
 def zstd_decoder():
-    """How this process decodes a zstd layer: ('module', mod) | ('program', 'zstd') | (None, why). Decided once."""
+    """How this process decodes a zstd layer: ('module', mod) | ('program', 'zstd') | (None, why). Decided once;
+    zstd_decoder_how() says it in words for the log."""
     if "d" not in _ZSTANDARD:
         mod, how = zstandard_module()
         if mod:
-            _ZSTANDARD["d"] = ("module", mod)
+            _ZSTANDARD["d"], _ZSTANDARD["how"] = ("module", mod), how
         elif shutil.which("zstd"):
-            _ZSTANDARD["d"] = ("program", "zstd")
+            _ZSTANDARD["d"], _ZSTANDARD["how"] = ("program", "zstd"), "the zstd program"
         else:
-            _ZSTANDARD["d"] = (None, how)
+            _ZSTANDARD["d"], _ZSTANDARD["how"] = (None, how), "NONE — " + how
     return _ZSTANDARD["d"]
 
 
+def zstd_decoder_how():
+    zstd_decoder()
+    return _ZSTANDARD["how"]
+
+
 def split_ref(ref):
     """'rommapp/romm:5.4.1' -> (registry, path, tag). lscr.io is Docker Hub's mirror (the watch's rule)."""
     tag = "latest"