ci: complete the template alignment with the copier-rendered workflow pipeline

[jacaudi]

Completes the jacaudi/template alignment that #42 started. #42 landed the non-workflow half — taskfile.yml, .taskfiles/, scripts/, the lint configs. This lands the workflows, rendered from gh:jacaudi/template@a676cfe with the answers now recorded in .copier-answers.yml (withheld from #42 on purpose so the recorded template state never claimed more than was there).

Deletes build-images.yaml, pull-request-workflow.yaml, manual-dev-release-workflow.yaml, release.yaml.

Refs #37, #41. Lands the registry half of #36. Closes the Go-pinning criterion left open on #40.

What the template does not cover for this repo

1. ci-build.yml cannot publish either image, so it gets a file: input. This is the one place copier update will conflict, and it is deliberate. Upstream cut file:, reasoning that a repo whose Dockerfile is elsewhere moves its context:. That assumes the Dockerfile and the context can be the same directory. Both images here live at images/*/Dockerfile and both COPY go.mod cmd api internal, so both need the repo root as context while neither sits at it:

• context: . → no Dockerfile or Containerfile in .
• context: images/manager → resolves, then dies at the COPY

No value of build_context builds either one. extra_build_contexts is not an escape hatch — ci.yaml's build-check matrix passes only context:, same constraint, and ci-build-check.yml never pushes. The block added is ci-build-check.yml's resolution logic verbatim; that stage already ships this exact input for the same reason, so this is the template's own pattern, merely absent from the stage that publishes. Worth upstreaming to drop the deviation.

2. A second build job for the agent, not a matrix leg — ci-build.yml declares outputs.image, and matrixed outputs are last-leg-wins, which would hand smoke whichever digest finished last. build-agent is in the ci gate's needs, or it could fail without failing ci.

3. The controller-gen drift gate, carried over from #39. Invoked as make manifests generate rather than a bare controller-gen call, so CONTROLLER_TOOLS_VERSION and the generator flags stay single-sourced in the Makefile.

4. A drift gate for release.yaml (hack/release-file-drift.sh). It is kustomize-generated from config/ and is the documented install path. Pins are read back out of the committed file rather than passed in: the Makefile defaults are dev values, and the committed pins are release-scoped. So it checks structure against config/ and leaves versioning to release time.

Both gates fail on drift and never fix it — a CI step that mutates the tree hides the problem it exists to surface.

Three defects found while building

ci-integration.yml's setup-envtest pin does not resolve, in any consumer of the template. go install sigs.k8s.io/controller-runtime/tools/setup-envtest@v0.22.1 fails with module ... found, but does not contain package .../tools/setup-envtest. It is a separate module whose only released tags are v0.24.0/v0.24.1, so a controller-runtime version is never valid for it — and the stock renovate annotation names the wrong module, so it would keep proposing uninstallable versions. Pinned v0.24.1, annotation corrected. Asset version lowered from 1.34.x to 1.30.0 to match this repo's k8s.io/* v0.30 stack behind controller-runtime v0.18.5.

Two latent Makefile bugs, both surfaced by running the new drift gate rather than by reading:

• The four tool rules took $(LOCALBIN) as a normal prerequisite, so installing any one tool made every other look stale; make re-ran its installer and kustomize's refuses with exists. Remove it first. ci-lint.yml reproduces the trigger exactly. Fixed with order-only prerequisites.
• generate-release-file and run-e2e "restored" two config/ files with git checkout, which restores from the index and therefore silently discards uncommitted edits to them. It ate an in-progress rename during this branch, with no output. Replaced with an explicit save/restore in a trap.

release.yaml was tracked and gitignored. Inert, since tracking wins — but the drift gate's own remediation is "regenerate and commit", and git add against an ignored path is a silent no-op.

Known coverage gap: no e2e stage

pull-request-workflow.yaml ran a third tier on a kind cluster. The template models unit + envtest only, so this swap drops it. Not restored deliberately: internal/it's wstunnel spec waits on Deployment readiness, which the pre-patch Deployment already satisfies, so it can assert before the controller rebuilds the pod spec. Wiring an intermittently-red suite into ci — the single required check — would leave main randomly unmergeable. The right fix is waiting on observedGeneration; #2 narrows the window but does not close it. make run-e2e still works locally. Recorded in ci.yaml.

Verified before pushing

task ci	golangci-lint 0 issues, govulncheck 0
envtest suite	79s — the real signature, not a silent zero-test pass
both images	build with context: . + explicit file:
task smoke	passes against the built manager
actionlint, local-refs, run-scripts-exist, run-interpolation	clean
codegen + release.yaml drift gates	pass, including under ci-lint's exact step order
commits	6, all signed

Tag/stage agreement checked with go test -list, since a wrong tag runs zero tests and reports success: -tags=integration selects internal/controller, -tags=e2e selects internal/it, and untagged selects neither.

Reviewer notes

• copier update will conflict on ci-build.yml. Keep the file: input; see the comment on the input itself.
• First merge to main opens a release PR at 2.11.0 → 2.11.1/2.12.0 depending on the commit types here. The manifest is seeded via .github/release-please-manifest.json, never release-as.
• release-republish.yml repairs the manager only — noted in the file with the manual incantation for the agent.
• Still to do after merge: create a ruleset requiring exactly ci. There is no ruleset at all today, so nothing can break before then, and it must be created after these workflows land, never before.