CES-96: re-pin agent-workloads sha-de9135d8ed21

[cesaregarza]

Summary

• Re-pin SplatTopConfig to an immutable agent-workloads release.
• Apply generated registry overlay manifest/image pins and Helm values.
• Surface mandateReleasePins so token rotation uses the same computed digests.

Provenance

• Source repo: cesaregarza/agent-workloads
• Source commit: de9135d8ed217bd182162e565536a7bcf031521a
• Publish run id: 27491058367

Digest Pins

workload	image digest	manifest digest	code digest
data.workspace_probe	sha256:2e77769ba180d98fcc630a1cd090ef8ac7e2a237c1b2ead2ffc6f8a9ca923f09	sha256:7aa7d616ab8b60263fb29bb29529f834dd0d4a02e8818392eecd033e2c1dbcb3	sha256:15f65e465c8a4a1263ce2a992c340419186e6ed25390b07d42de5afde91b7bb4
opencode.apply_executor	sha256:dcba8148765d8bb97f2cad7919567333dc3b42215a3506a95c081cf356f66c3f	sha256:9c471da6268f25b8d441f500f2f0b43116875b9e7a867cb5c72db4046957fe77	sha256:3783f59b2dfc7c2bf54688ffc9469d846f63b55ecad015df6b12aaeaadf6a3fe
opencode.proposer	sha256:21efb63d0af10f2fcc6b3b5aa9f4ad1f1b48501fa05b2b55eaf81bc2d96b4e25	sha256:c8aa26bc3e3969d4161ee18116e39fe95276fd38adb14ab30cd856c9a9c67ebf	sha256:1cc9b4bb5af9c2d12779a0c6a4ef9849f23b3cf547eff4eb5720a267968efc69

Safety

• This PR does not mint workload identity tokens.
• The SplatTopConfig drift gate must pass before merge: decrypted workload identity token code_digest claims must match mandateReleasePins and the embedded registry overlay manifests.
• No mutable :latest image tag is introduced.

Refs CES-96.