CES-96: re-pin agent-workloads sha-afb597299740

[cesaregarza]

Summary

• Re-pin SplatTopConfig to an immutable agent-workloads release.
• Apply generated registry overlay manifest/image pins and Helm values.
• Surface mandateReleasePins so token rotation uses the same computed digests.

Provenance

• Source repo: cesaregarza/agent-workloads
• Source commit: afb597299740b5a1d9327f7c71d51e4deec4395a
• Publish run id: 27802830436

Digest Pins

workload	image digest	manifest digest	code digest
data.workspace_probe	sha256:fe7c2125541e86f72cf3d6c07f8b707e4b7d9c9c70f311bc726ae409a35503e9	sha256:5c51f3d6a0c71e796ce271e8e7982090e1228ba6b872eda6e0c08de323f2943d	sha256:98b2ea0fb10da593f83c1373faa86fc652c893fb21877c74d430575512443ac0
opencode.apply_executor	sha256:fbe99bbf564955b7a4dac7178ba370fb63337d204868348e9d8473dcab910cbd	sha256:ece8d60c8469c2059a0c62a54261a49102ef87d090d0a22cb15f3d4d8a23490d	sha256:1274f4f90542689deaca6ec1d10553d58f14aa893c2b551951fb72b382405636
opencode.proposer	sha256:5de4ce74451915e87749295db9bdccb2e8a5b5437722ba6a160bba65c4572032	sha256:8f00106d46036c0a6ec3ed4a73fa3196c9ecd7ac8ae6dfed3d3a6dffc59a07ed	sha256:6f752da35e78aadbda0258aaa1642ab9534ddae8ab6fc0c86e701ed6d83acd68

Safety

• This PR does not mint workload identity tokens.
• The SplatTopConfig drift gate must pass before merge: decrypted workload identity token code_digest claims must match mandateReleasePins and the embedded registry overlay manifests.
• No mutable :latest image tag is introduced.

Refs CES-96.