ci(release): publish the agent image as an amd64+arm64 index

[rigel-mintaka]

This PR is part of a stack containing 2 PRs:

1. main
2. "ci(release): publish the agent image as an amd64+arm64 index" (this PR)
3. refactor(release): move the agent-image index publish logic into a tested tool #1804

Summary

• Split publish-image into publish-image-amd64 (ubuntu-latest) and publish-image-arm64 (ubuntu-24.04-arm). Each job pushes only its immutable git-<sha12>-<arch> tag.
• New publish-image-manifest job:
  • builds the index by digest, amd64 first, then arm64;
  • asserts two members;
  • guards :git-<sha12>: an equal list digest skips, a different one fails, only manifest-unknown pushes, and any other error aborts.
• :latest moves only when this sha is on main and no newer main commit has a published :git index. Runs can reach this job out of commit order, so an older run cannot move :latest backward. :latest must then match the newest published index, or the job fails.
• The job then verifies the platform set, the member digests, each member's config platform, and that :latest matches when it moved.
• release-image copies the full index to :vX.Y.Z with --multi-arch all --preserve-digests, then verifies and exports the list digest.
• tools/release-notes records the manifest digest (sha256 of the raw bytes), so an index is reported as itself.
• publish.sh requires --arch-suffix or explicit tags; a bare call now errors. It also truncates the sha to exactly 12 characters, matching the index job.
• The temporary arm64 spike job is removed.

Verification

• The arm64 build was proven on a throwaway ref: release.yml run 37413566470.
• Local registry:2 harness with real busybox amd64 and arm64 members:
  • index push: a fresh push succeeded, a rerun skipped, a tampered tag failed, and registry-down failed;
  • the release-image copy kept the index list digest and both platforms (a plain copy produced one image manifest);
  • the :latest guard behaved correctly in five cases: no newer index, newer index published, tip run, sha not on main (aborts), registry down (aborts).
• bun test in tools/release-notes: 26 pass. The two new digest tests fail against the old code.
• biome check tools/release-notes and shellcheck agent-image/publish.sh are clean.
• actionlint findings match main's baseline exactly.
• Deferred: permanent tests for the publish guards need the inline shell moved into a TS tool; tracked in RIG-4735.
• Not run: the publish and release jobs, because they are guarded to run only on main.

Risks

The first main run is the real test of the index job. A failure leaves :latest on the previous amd64 image. Rollback is a revert. GitHub runners ship podman 4.9.3; the flags used are present there.

Compatibility

:latest, :git-<sha12> and :vX.Y.Z become multi-arch indexes. amd64 pulls resolve to the same kind of image as before. The release body's image digest is now the index digest instead of a config digest. Calling publish.sh with no arguments now fails.

Documentation

None: CI-only change. The behaviour follows the existing design record.

Refs RIG-3751

[trunk-io]

😎 This pull request was merged.

[linear-code]

RIG-3751

[github-actions]

Compass engineering docs preview: https://compass-native-rig-3751-agen.compass-eng-docs.pages.dev

Deployed from compass-native/rig-3751-agent-image-index at 053a33b.

[trunk-io]

This pull request is queued for merge as part of 1804, which will merge 1775, 1804.

[trunk-io]

This pull request was merged into main as part of stacked PR 1804.