fix(ci): stop the runtime image build failing on the digest filename

[beatsmonster]

The problem

.github/workflows/runtime-image.yml has never published a tag — 47 runs on record, 0 successes. Every one dies in the same place:

##[error]The path for one of the files in artifact is not valid:
/sha256:3417960f8aa9…  Contains the following character:  Colon :

Export the digest names its marker file after the raw build output, sha256:<hex>. actions/upload-artifact@v4 rejects any path containing a colon, so both matrix legs fail after pushing their layers, and manifest (needs: build) is never reached. The two architectures have therefore only ever existed in ghcr.io as untagged digests — :latest, :<sha> and every release tag are absent.

That is the failure the file's own header warns about: factory contained setup pulls and does not build, so this is the entire cold start for a new user.

The fix

1. Strip the sha256: prefix when naming the digest file, passed through env: rather than interpolated. The manifest step's existing sed 's/^sha256://' puts it back and stays tolerant of either form.
2. A latent second failure in a step that, because of the above, had never once executed: the architecture check grepped the raw manifest bytes for "architecture":"amd64", which only matches when buildx marshals the index compactly. It now reads the index with jq, so a whitespace change cannot fail the check on a good image after the tags are already pushed.

Verification

Dispatched on this branch under a throwaway tag, so an unmerged branch could not move :latest — run 32533265869, green:

Publishing tags: digest-fix-probe
Name:      ghcr.io/akashgit/remote-factory/factory-runtime:digest-fix-probe
MediaType: application/vnd.oci.image.index.v1+json
  Platform:    linux/arm64
  Platform:    linux/amd64

…and the smoke test pulled that manifest and ran it: factory --help, tmux 3.5a, git version 2.52.0.

One piece of cleanup for someone with packages: write on the registry: the throwaway :digest-fix-probe tag can be deleted once this merges. On merge, the push to main republishes :latest and :<sha> for real.

🤖 Generated with Claude Code

[github-actions]

Sentrux Quality Report

Absolute

Scanning ....
[scan] git ls-files: 624 total, 610 kept, 14 dropped (ext:14, meta:0, big:0)
[build_project_map] 610 files, 106 unique dirs, 97 cache misses, 5.1ms
[resolve] 1149 resolved, 1535 unresolved (of 2684 total specs)
[resolve_imports] project_map 5.3ms, suffix_idx 1.1ms, suffix_resolve 18.0ms, total 24.3ms
[build_graphs] 610 files | maps 2.2ms, imports 24.5ms, calls+inherit 6.6ms, total 33.3ms | 1148 import, 8598 call, 1 inherit edges
sentrux check — 3 rules checked

Quality: 4467

✗ [Error] max_cc: 3 function(s) exceed max cyclomatic complexity of 30
    factory/cli/_ceo_helpers.py:_validate_ceo_flags (cc=43)
    factory/cli/_ceo_helpers.py:_execute_ceo (cc=43)
    factory/cli/run.py:cmd_run (cc=32)

✗ 1 violation(s) found

Diff (vs base branch)

Scanning ....
[scan] git ls-files: 624 total, 610 kept, 14 dropped (ext:14, meta:0, big:0)
[build_project_map] 610 files, 106 unique dirs, 97 cache misses, 5.1ms
[resolve] 1149 resolved, 1535 unresolved (of 2684 total specs)
[resolve_imports] project_map 5.2ms, suffix_idx 1.0ms, suffix_resolve 24.1ms, total 30.4ms
[build_graphs] 610 files | maps 2.3ms, imports 30.6ms, calls+inherit 7.2ms, total 40.1ms | 1148 import, 8598 call, 1 inherit edges
sentrux gate — structural regression check

Quality:      4467 -> 4467
Coupling:     0.80 → 0.80
Cycles:       4 → 4
God files:    3 → 3

Distance from Main Sequence: 0.39

✓ No degradation detected

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.84%. Comparing base (887f317) to head (6bbf818).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1379      +/-   ##
==========================================
+ Coverage   84.83%   84.84%   +0.01%     
==========================================
  Files         205      205              
  Lines       23287    23287              
  Branches     3700     3700              
==========================================
+ Hits        19755    19758       +3     
+ Misses       2696     2693       -3     
  Partials      836      836              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.