fix: run product capture provider in runtime image

[intel352]

Summary

• copy the Linux product-capture provider binary into the browser runtime image
• set the runtime image entrypoint to the provider binary so workflow-compute JSON envelopes on stdin are handled by the provider, not Node
• build the provider binary in the release runtime-image job before Docker build
• add regressions for the image entrypoint and release workflow binary build step

Failure evidence

workflow-compute Staging Product Capture Proof run 27071404495 loaded and launched the promoted OCI runtime, but the image had no provider entrypoint. Node interpreted the JSON envelope on stdin as JavaScript and failed with SyntaxError: Unexpected token :.\n\n## Verification\n- GOWORK=off go test ./... -run 'TestRuntimeImageRunsProductCaptureProviderEntrypoint|TestReleaseWorkflowBuildsRuntimeProviderBinaryBeforeImage'\n- GOWORK=off go test ./...\n- GOWORK=off go build -o /tmp/product-capture-provider-test ./cmd/product-capture-provider && /tmp/product-capture-provider-test --probe >/tmp/product-capture-provider-probe.json && jq -e '.provider == "workflow-plugin-product-capture" and .executor_provider == "product-capture-browser"' /tmp/product-capture-provider-probe.json\n- actionlint .github/workflows/release.yml .github/workflows/ci.yml .github/workflows/tag-immutability.yml && git diff --check\n\nNot run: full Docker build of the Chrome/Playwright image locally.

[Copilot]

Pull request overview

This PR fixes the product-capture browser runtime image so it executes the Go product-capture provider binary (reading workflow-compute JSON envelopes from stdin) instead of defaulting to Node, and adds regression checks to prevent reintroducing the missing-entrypoint failure.

Changes:

• Copy the product-capture-provider binary into the runtime image and set it as the image ENTRYPOINT.
• Update the release workflow to build the provider binary before building/pushing the runtime image.
• Add Go tests that assert the Dockerfile and release workflow include the expected entrypoint and build steps.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

File	Description
release_workflow_test.go	Adds regression tests for runtime image entrypoint and release workflow build step.
docker/product-capture-browser/Dockerfile	Copies provider binary into the image and sets it as ENTRYPOINT.
.gitignore	Ignores the generated provider binary in the docker directory.
.github/workflows/release.yml	Builds the provider binary prior to the Docker build/push step.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.