[FEATURE] Pin operator image for ArgoCD path-based install

[inference-gateway-maintainer]

Summary

PR #242 (fix for #239) pins ghcr.io/inference-gateway/operator to the released version in the uploaded install.yaml asset. The committed manifests/install.yaml intentionally keeps :latest (CI fails if task manifests output drifts from what is committed), and the release notes' GitOps/ArgoCD snippet points at path: manifests of the release tag - which reads the committed manifest. So an ArgoCD install pinned to a tag still runs an operator image tagged latest, defeating the point of pinning the release.

Candidate approaches:

• Commit a version-pinned manifests/install.yaml during release (add it to @semantic-release/git assets) - requires updating the CI manifest-drift check, which currently fails if task manifests output differs from what is committed.
• Have ArgoCD users consume the release asset (e.g. install.yaml attached to the GitHub release tag) instead of path: manifests.
• Ship a kustomize overlay (e.g. manifests/release/) with the pinned image that the semantic-release plugin rewrites.

Acceptance Criteria

• The ArgoCD install snippet in the release notes yields a version-pinned operator image (no :latest).
• Any approach keeps task manifests output identical to what is committed in the repo.
• Install docs / release notes stay consistent with the recommended method.

[edenreich]

@claude [effort:xhigh] Can you work on this? use /ponytail:ponytail please use the most elegant solution, don't guess.

[inference-gateway-maintainer]

Claude finished @edenreich's task in 7m 10s —— View job • feat/issue-245-20260925-0104 • [Create PR ➔](https://github.com/inference-gateway/operator/compare/main...feat/issue-245-20260925-0104?quick_pull=1&title=Issue%20%23245%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%23245%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

---

Done - PR #248

• Gather context (release workflow, .releaserc.yaml, pin plugin, kustomize overlays, CI drift check, docs)
• Decide on the approach
• Implement
• Verify (task manifests drift check + release simulation, regex checks, prettier)
• Commit + open PR (#248)

Approach

Pin the image where the manifest is generated, so "generated" and "committed" stay the same file by construction - no change to the CI drift check, no second manifest, no new overlay.

• config/environments/prod/kustomization.yaml now owns the operator image tag (images[].newTag). The identical images block in config/operator/kustomization.yaml was a no-op (newName/newTag matched operator.yaml exactly) and is removed, so the dev overlay - and therefore task deploy and the e2e suite, which import a locally built :latest image - is untouched.
• .github/semantic-release/pin-operator-image.cjs rewrites that newTag as well as manifests/install.yaml, and @semantic-release/git commits both. The release tag points at that commit, so ArgoCD path: manifests @ tag gets the pinned image - and task manifests still reproduces the committed manifest byte-for-byte, because the pin lives in the kustomize source of truth.

Release-notes and README snippets are unchanged in shape; they are simply pinned now. Docs updated in README.md, manifests/README.md, AGENTS.md.

Verification

Check	Result
task manifests after moving the images block	manifests/install.yaml unchanged, tree clean - the move is a no-op
Release simulation (newTag: 9.9.9 + task manifests)	exactly one line changed, image: ...operator:9.9.9 - identical to what the plugin writes, so the release commit is drift-free
Plugin regexes vs. the real files	both matched via grep -P (incl. the multiline newTag anchor)
prettier --check on all changed files	clean (the README.md warning pre-exists on main)

Not done: node .github/semantic-release/pin-operator-image.cjs (the plugin self-check) could not run here - node is not in this job's allowed tools - so it is worth running once locally; the regexes it asserts were verified with grep -P instead. No Go code changed, so no Go tests were run. Filed inference-gateway/docs#765 for the user-facing docs update, and moved the issue to QA on the roadmap board.

One behavioural note for review: after each release main carries the released image tag instead of latest, which is what makes the tagged tree pinned. Installing straight from main therefore gives the most recent release rather than a floating latest.
| Branch | PR #248

[inference-gateway-releaser]

🎉 This issue has been resolved in version 0.26.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀