ci(images): promote canary-validated runtime defaults by digest

[Verolop]

Background

Runtime defaults should not advance merely because a proto revision exists. They should advance after the corresponding images have verified provenance and pass compatibility testing.

The nightly workflow already resolves immutable digests for multigres, pgctld, and multiadmin-web, verifies them, and runs e2e. A successful scheduled canary should create or update one reviewed promotion PR containing those exact digests.

Required changes

Record the upstream revision, tested operator revision, nightly run, canary run, and three verified digests in a machine-readable promotion record.

Promote the three digests atomically across the six upstream-owned defaults in image_defaults.go. Map pgctld to DefaultPostgresImage; multigres to DefaultMultiadminImage, DefaultMultiorchImage, DefaultMultipoolerImage, and DefaultMultigatewayImage; and multiadmin-web to DefaultMultiadminWebImage. Do not modify the etcd or Postgres exporter defaults.

Only canonical scheduled runs against main may promote. The promotion PR should be updated in place, explain the old and new image set, and run e2e using its committed defaults. Reprocessing the same digest set must be a successful no-op, while a newer green set updates the existing PR atomically.

Keep compatibility reporting and promotion as sibling terminal jobs with separate permissions. A green canary may close the compatibility incident, but its revision is recorded as fully handled only after the promotion PR is created or updated. If promotion fails, the workflow remains red and the revision remains eligible for retry; it must not be reported as a compatibility failure.

Acceptance criteria

• A scheduled green canary creates or updates one digest-pinned promotion PR.
• Provenance, source revision, and amd64/arm64 availability are verified.
• The promotion record, six constants, and e2e-tested defaults agree.
• Manual runs, stale revisions, and failed PR updates cannot advance defaults.
• Compatibility reporting has only issues: write; promotion has only contents: write and pull-requests: write.
• A failed promotion leaves the workflow red and the revision retryable without opening a compatibility incident.

References

• Existing image-sync behavior: fix: update sync workflow to bump default images used #519
• Compatibility tracker: Nightly compatibility canary failing at multigres/unknown #574