main
filter-by-os is ignored when the image isn't a manifest-list; leading to false positives in the check