ci: orchestrate verified operator releases

[rusenask]

Summary

• stage and verify the exact amd64/arm64 operator image plus both relay-agent variants
• run K3s and protected production delivery against digest-pinned images before immutable version/chart promotion
• publish latest and a byte-verified draft GitHub release only after every gate
• remove the legacy release-triggered rebuild and add retry/collision/order fixtures

Release mapping

• operator: 0.8.0
• chart: 0.7.0
• relay agent: 1.37.0

Validation

• make release-workflow-test
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 .github/workflows/*.yml
• go test ./...
• make chart-package HELM_BIN=helm

Phase 15: #46

---

Note

High Risk
Changes production release orchestration, Docker Hub promotion, and live production e2e against real Relay credentials; chart lifecycle may still download artifacts without run_attempt while upload uses it, which could break packaged-chart K3s gates.

Overview
Replaces the legacy release-triggered image workflow with a tag-driven Operator Release pipeline (0.* tags) that validates operator/chart/agent version mapping, builds or resumes a commit-scoped multi-arch operator image via ko, smoke-tests operator and pinned relay-agent digests, runs protected production live delivery, then promotes immutable version/latest tags and publishes the Helm chart before creating a byte-verified GitHub release from draft assets.

Helm and CI: The chart gains optional image.digest (overrides tag) in values, deployment template, and README. Chart release artifacts are keyed by run_attempt for publish/resume. CI runs release-workflow-test, image-release fixtures, and asserts digest rendering in helm template.

E2E: K3s harness can deploy a published operator by digest/tag (WHR_E2E_OPERATOR_IMAGE, platform digest check); production workflow is reusable via workflow_call with digest-pinned images and an always-run Relay bucket cleanup script.

Tooling/docs: Adds .ko.yaml, .scripts/image-release.sh, fake registry tests, and updates releasing.md / modernization plan for phase 16.

^{Reviewed by Cursor Bugbot for commit 270a007. Configure here.}