fix: combine per-arch tags with imagetools, not docker manifest

docker manifest create refuses a source that is itself a manifest list:
  ERROR: ...:<tag>-amd64 is a manifest list
With Docker containerd image store, docker build --platform linux/amd64
produces an OCI index rather than a plain manifest, so BOTH per-arch tags are
lists and the combine fails — after the slow multi-hundred-MB pushes have
already succeeded. The failure mode is nasty: the per-arch tags are published
and the PLAIN tag, the one both Deployments reference, is absent. Hit on
12.11.1-ci6, 2026-08-31.

buildx imagetools create accepts indexes as sources and combines registry-side,
so it works with either image store. Verification switches to imagetools
inspect and now asserts both linux/amd64 and linux/arm64 specifically, rather
than counting two distinct architecture strings.

.github/workflows/probe-buildkitd.yml

@@ -1,66 +0,0 @@
-name: probe registry from buildkitd
-
-# TEMPORARY probe branch — not for merge.
-#
-# The first probe ran in the RUNNER pod. buildkitd is a different pod in a
-# different namespace with its own NetworkPolicies, so those results cannot be
-# transferred: an UNREACHABLE there may be the runner's policy, not routing.
-# This runs the same probes THROUGH buildkitd, by building a stage whose RUN
-# does the curling — that egresses from the buildkitd pod, which is the network
-# position that actually has to push.
-#
-# It prints results and always exits 0: this is a measurement, not a gate.
-
-on:
-  workflow_dispatch:
-
-env:
-  BUILDKIT_HOST: tcp://buildkitd.buildkit-system.svc.cluster.local:1234
-  BUILDKIT_VERSION: v0.32.2
-
-jobs:
-  probe:
-    if: ${{ github.server_url != 'https://github.com' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - name: Install buildctl
-        run: |
-          set -euo pipefail
-          case "$(uname -m)" in x86_64) arch=amd64;; aarch64) arch=arm64;; *) exit 1;; esac
-          mkdir -p "$GITHUB_WORKSPACE/.bin"
-          curl -fsSL "https://github.com/moby/buildkit/releases/download/${BUILDKIT_VERSION}/buildkit-${BUILDKIT_VERSION}.linux-${arch}.tar.gz" \
-            | tar -xz -C "$GITHUB_WORKSPACE/.bin" --strip-components=1 bin/buildctl
-          echo "$GITHUB_WORKSPACE/.bin" >> "$GITHUB_PATH"
-          "$GITHUB_WORKSPACE/.bin/buildctl" --version
-
-      - name: Probe from inside buildkitd
-        run: |
-          set -euo pipefail
-          work=$(mktemp -d)
-          {
-            echo 'FROM alpine:3.20'
-            echo 'RUN apk add --no-cache curl >/dev/null 2>&1 || true'
-            echo 'RUN set -u; \'
-            echo '  f="http=%{http_code} tls=%{ssl_verify_result} t=%{time_total}\\n"; \'
-            echo '  echo "== public name via cluster DNS =="; \'
-            echo '  curl -s -o /dev/null -w "$f" --max-time 8 https://gitea.langenoja.se/v2/ || echo UNREACHABLE; \'
-            echo '  echo "== resolves to =="; getent hosts gitea.langenoja.se || echo "(none)"; \'
-            echo '  echo "== istio-gateway external lb 10.40.0.10 =="; \'
-            echo '  curl -s -o /dev/null -w "$f" --max-time 8 --resolve gitea.langenoja.se:443:10.40.0.10 https://gitea.langenoja.se/v2/ || echo UNREACHABLE; \'
-            echo '  echo "== istio-gateway clusterip 10.43.1.114 =="; \'
-            echo '  curl -s -o /dev/null -w "$f" --max-time 8 --resolve gitea.langenoja.se:443:10.43.1.114 https://gitea.langenoja.se/v2/ || echo UNREACHABLE; \'
-            echo '  echo "== gitea http service in-cluster =="; \'
-            echo '  curl -s -o /dev/null -w "$f" --max-time 8 http://gitea-system-gitea-http.gitea-system.svc.cluster.local:3000/v2/ || echo UNREACHABLE; \'
-            echo '  echo "== gitea http service, headers =="; \'
-            echo '  curl -s -D- -o /dev/null --max-time 8 http://gitea-system-gitea-http.gitea-system.svc.cluster.local:3000/v2/ | head -5 || true'
-          } > "$work/Dockerfile"
-          cat "$work/Dockerfile"
-          buildctl build --progress=plain \
-            --frontend dockerfile.v0 \
-            --local context="$work" \
-            --local dockerfile="$work" \
-            --opt platform=linux/amd64 2>&1 | tee /tmp/probe.log | tail -80
-          echo "=== PROBE RESULTS ==="
-          grep -E "^#[0-9]+ [0-9.]+ " /tmp/probe.log | sed -E "s/^#[0-9]+ [0-9.]+ //" || echo "(no RUN output captured)"
-          echo "probe finished (results above, from buildkitd's network position)"

.github/workflows/probe-registry.yml

@@ -1,47 +0,0 @@
-name: probe registry endpoints
-
-# TEMPORARY probe branch — not for merge. Answers one question with evidence
-# instead of inference: which registry endpoints are reachable from a pod inside
-# this cluster, after 10.40.0.10 (the istio-gateway LoadBalancer EXTERNAL
-# address) turned out to be connection-refused from the pod network while
-# answering fine from a LAN workstation.
-
-on:
-  workflow_dispatch:
-
-jobs:
-  probe:
-    if: ${{ github.server_url != 'https://github.com' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Probe candidate registry endpoints
-        run: |
-          set -u
-          fmt='http=%{http_code} tls=%{ssl_verify_result} t=%{time_total}\n'
-
-          echo "--- public name via cluster DNS (the path that works today) ---"
-          printf '%-46s ' 'gitea.langenoja.se:443'
-          curl -s -o /dev/null -w "$fmt" --max-time 8 https://gitea.langenoja.se/v2/ \
-            || echo "UNREACHABLE"
-
-          echo "--- istio-gateway EXTERNAL lb ip (what #949 pinned) ---"
-          printf '%-46s ' '10.40.0.10:443'
-          curl -s -o /dev/null -w "$fmt" --max-time 8 \
-            --resolve gitea.langenoja.se:443:10.40.0.10 https://gitea.langenoja.se/v2/ \
-            || echo "UNREACHABLE"
-
-          echo "--- istio-gateway CLUSTER ip (candidate) ---"
-          printf '%-46s ' '10.43.1.114:443'
-          curl -s -o /dev/null -w "$fmt" --max-time 8 \
-            --resolve gitea.langenoja.se:443:10.43.1.114 https://gitea.langenoja.se/v2/ \
-            || echo "UNREACHABLE"
-
-          echo "--- gitea http service, in-cluster, plain http ---"
-          printf '%-46s ' 'gitea-system-gitea-http:3000'
-          curl -s -o /dev/null -w "$fmt" --max-time 8 \
-            http://gitea-system-gitea-http.gitea-system.svc.cluster.local:3000/v2/ \
-            || echo "UNREACHABLE"
-
-          echo "--- what this pod resolves the public name to ---"
-          getent hosts gitea.langenoja.se || echo "(getent failed)"

push-image.sh

@@ -99,15 +99,27 @@ for arch in amd64 arm64; do
   docker push "$REPO:$TAG-$arch" || die "push failed for $arch"
 done
 
-docker manifest rm "$REPO:$TAG" >/dev/null 2>&1 || true
-docker manifest create "$REPO:$TAG" --amend "$REPO:$TAG-amd64" --amend "$REPO:$TAG-arm64"
-docker manifest push "$REPO:$TAG"
+# `docker manifest create` REFUSES a source that is itself a manifest list:
+#   ERROR: gitea.langenoja.se/...:<tag>-amd64 is a manifest list
+# With Docker's containerd image store, `docker build --platform linux/amd64`
+# produces an OCI index rather than a plain manifest, so both per-arch tags are
+# lists and the combine step fails after the (slow, large) pushes have already
+# succeeded — leaving the per-arch tags published and the plain tag absent,
+# which is the one the Deployments reference. Seen on 12.11.1-ci6, 2026-08-31.
+#
+# `buildx imagetools create` accepts indexes as sources and does the combine
+# registry-side, so it works with either image store.
+docker buildx imagetools create -t "$REPO:$TAG" "$REPO:$TAG-amd64" "$REPO:$TAG-arm64" \
+  || die "failed to combine the per-arch tags into $REPO:$TAG"
 
 # Verify by reading it back, rather than trusting the push's exit code.
 echo "verifying the published manifest lists both architectures"
-got=$(docker manifest inspect "$REPO:$TAG" | grep -o '"architecture": *"[a-z0-9]*"' | sort -u | wc -l)
-[ "$got" -ge 2 ] || die "published manifest does not list two architectures"
-docker manifest inspect "$REPO:$TAG" | grep -o '"architecture": *"[a-z0-9]*"' | sort -u
+inspect=$(docker buildx imagetools inspect "$REPO:$TAG") \
+  || die "published $REPO:$TAG cannot be read back"
+got=$(echo "$inspect" | grep -o 'linux/[a-z0-9]*' | sort -u | grep -cE 'linux/(amd64|arm64)')
+[ "$got" -ge 2 ] || die "published manifest does not list both architectures:
+$inspect"
+echo "$inspect" | grep -o 'linux/[a-z0-9]*' | sort -u
 
 cat <<EOF