eval: publish and pin the egress proxy image by registry digest

[hqhq1025]

Context

PR #2947 builds maka-eval-egress-proxy:12.2.3 locally from the checked-in Dockerfile and policy. The tag is versioned, and the per-cell health gate plus policy tests fail closed, but a local Docker tag is still mutable and has no portable RepoDigest until the image is published to a registry.

Required follow-up

1. Add a release workflow that builds packages/eval/harbor/egress-proxy/Dockerfile from the reviewed source.
2. Publish the image to the project registry for Linux amd64 (and any additional supported architectures).
3. Record the immutable manifest digest in the Eval spec/Compose overlay.
4. Make executor preflight reject a missing or mismatched digest before starting Harbor.
5. Add a regression test proving that a stale same-name local tag cannot satisfy the pinned deployment contract.

Why separate

A valid digest must identify a published registry manifest. Pinning the current machine-local image ID would be host/build-instance-specific and would not be reproducible for CI or another VMSS node.

[DaBestCode]

take

[DaBestCode]

I’d like to implement this, starting with Linux amd64.

The proposed scope is:

• Build the proxy from the checked in Dockerfile through a maintainer controlled publication workflow.
• Pin the published registry manifest digest in the Eval deployment configuration.
• Make preflight reject an unavailable or mismatched pinned image before Harbor starts, without falling back to a same name local tag.
• Add regression coverage for stale tags, missing digests, and platform mismatch, and retain the existing egress-policy checks.

Which project-owned registry and image repository should this use? Is there an existing publication environment/authentication setup to reuse, or would a maintainer need to provision it and authorize the first publish?

I propose keeping image preparation explicit rather than having Eval preflight automatically build or pull images. Please let me know if you prefer a different deployment contract.

I used Codex to help inspect the code and prepare this scope, I’ll own the implementation and validation.