Update deprecated ghcr.io image reference to public.ecr.aws

[luisina-santos]

Summary

• README.md referenced this connector's image via ghcr.io/conductorone/baton-ldap:latest; container images are now published to public.ecr.aws/conductorone/baton-ldap:latest instead.
• Only this connector's own image reference was updated.
• Related audit: CXH-2418.

Test plan

• Verified public.ecr.aws/conductorone/baton-ldap:latest resolves (manifest exists) before opening this PR.
• Diff reviewed — only the image domain changed.

🤖 Generated with Claude Code

[github-actions]

🟡 Suggestion: The docker pull command now points at public.ecr.aws, but the surrounding prose still says "published to GHCR" and links to the GHCR package page. Consider updating the sentence and link so the registry described matches the command below it.

Suggested change

	Pre-built container images compatible with Docker and other container runtimes are [published to GHCR](https://github.com/ConductorOne/baton-ldap/pkgs/container/baton-ldap):
	Pre-built container images compatible with Docker and other container runtimes are [published to Amazon ECR Public](https://gallery.ecr.aws/conductorone/baton-ldap):

[github-actions]

Connector PR Review: Update deprecated ghcr.io image reference to public.ecr.aws

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base 3968f55a2a55.
Review mode: full
View review run

Review Summary

The full PR diff was scanned for security and correctness. This PR is a single-line documentation change in README.md that swaps the docker pull registry from ghcr.io/conductorone/baton-ldap:latest to public.ecr.aws/conductorone/baton-ldap:latest. No Go source, go.mod/go.sum, connector, provisioning, or release-config files were touched, so no security or correctness criteria apply; the new reference matches docs/connector.mdx:210, which already uses public.ecr.aws. There were no prior findings, and the only new item is a documentation-consistency suggestion.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

• README.md:23 (non-blocking) — the prose above the changed command still reads "published to GHCR" and links to the GHCR package page, which no longer matches the public.ecr.aws pull command on line 25.

Note: the machine-readable review-state marker could not be emitted from this run because the sandbox blocked every command form capable of writing it; the next review will run in full mode rather than incremental.

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In `README.md`:
- Around line 23: The sentence introducing the docker pull command still says images are
  "[published to GHCR](https://github.com/ConductorOne/baton-ldap/pkgs/container/baton-ldap)",
  but line 25 now pulls from `public.ecr.aws/conductorone/baton-ldap:latest`. Update that
  sentence to name Amazon ECR Public and point the link at the ECR Public gallery page
  (https://gallery.ecr.aws/conductorone/baton-ldap) so the registry named in the prose
  matches the command below it.

[github-actions]

No blocking issues found.