GA promote (no rebuild): retag :latest to the RC digest + manual dispatch (Plan 2)

[jsokol]

Summary

Plan 2 of the build-once-promote redesign. Makes GA of simplerisk-minimal a promotion of the already-built RC digest — no rebuild — building on Plan 1 (#147, merged to testing).

Design + plan (code-development docs/superpowers/):
specs/2026-07-10-release-image-promotion-design.md, plans/2026-07-10-docker-ga-promote-no-rebuild.md.

What changed (3 commits)

• promote-latest.yml — now a manual workflow_dispatch (no auto-promote on push). It (1) verifies the RC <V>-php85 tag exists, (2) currency-guards it (its digest must equal the floating :testing digest, so a stale committed version / stale dispatch ref can't promote an old release to prod), (3) retags DockerHub :latest → the <V>-php85 digest via docker buildx imagetools create (multi-arch preserved, no build step), and (4) sets prod SSM /simplerisk/customers/image-tag/latest = <V>-php85.
• push-to-dockerhub.yml — removed the two simplerisk-minimal-* jobs, so the master push no longer rebuilds the minimal image (full-stack simplerisk jammy/noble still rebuild). The minimal <V>/<V>-php8x tags come only from Plan 1's testing build; :latest moves only via the manual promote.

What is intentionally NOT changed

• GHCR (push-to-gh-pkgs.yml) keeps its independent minimal rebuild (out of build-once scope; nothing internal uses it).
• Full-stack simplerisk keeps its master-push rebuild.

Validation

• actionlint (promote-latest, push-to-dockerhub) — clean.
• Task-by-task review + whole-branch review (opus): verified manual-only trigger, no rebuild step, exact tag alignment with Plan 1, multi-arch-preserving retag, fail-closed guards (existence + currency), and a clean job removal with no dangling refs. The one Important finding (promote could ship a stale-but-existing version) was fixed with the currency digest guard.

Notes

• These workflows run on master (the GA leg), so they take effect when testing → master promotes them. This PR lands them on testing first, consistent with Build-once RC publish: immutable php83/84/85 + bare + :testing (Plan 1) #147.
• The GA promote is exercised end-to-end in Plan 4 (the 20260709-001 landing), which asserts :latest and :testing resolve to the same digest after promotion.

🤖 Generated with Claude Code