fix(#1774): update stale registry ref to conforma

[fullsend-ai-coder]

Update hack/update-infra-deployments.sh to use the conforma registry instead of the old enterprise-contract registry:

• Change TASK_POLICY_REF from quay.io/enterprise-contract/ec-task-policy
  to quay.io/conforma/task-policy (dropping the ec- prefix per naming
  convention)
• Update the sed match pattern to handle both old (ec-task-policy) and
  new (task-policy) image names in infra-deployments YAML files

---

Closes #1774

Post-script verification

• Branch is not main/master (agent/1774-update-stale-registry-ref)
• Secret scan passed (gitleaks — cfe02d00ddacd1a6c574f6a52d51da2c47d7b0ab..HEAD)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 12:26 PM UTC · Completed 12:31 PM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

Review — ✅ Approve

PR: fix(#1774): update stale registry ref to conforma
Scope: 1 file changed (hack/update-infra-deployments.sh), 2 additions, 2 deletions

Summary

Clean, well-scoped change that updates the last hardcoded enterprise-contract registry reference in hack/update-infra-deployments.sh to the conforma equivalent. Directly addresses issue #1774.

Changes reviewed

1. TASK_POLICY_REF update (line 30): Registry reference changed from quay.io/enterprise-contract/ec-task-policy:latest → quay.io/conforma/task-policy:latest. Follows the project's naming convention (drops ec- prefix under the conforma org).

2. Sed match pattern update (line 79): The BRE regex pattern now makes the ec- prefix optional via \(ec-\)\{0,1\}, enabling the script to match both old-format (ec-task-policy) and new-format (task-policy) image references in infra-deployments YAML files. This provides backward compatibility during the transition period.

Verification

• ✅ Regex correctness: Verified the BRE \(ec-\)\{0,1\} pattern correctly matches both ec-task-policy:* and task-policy:* paths
• ✅ Scope guard: The update_ecp_resources function filters to EnterpriseContractPolicy YAML resources only (via yq at line 63), so the broader regex has no risk of unintended matches
• ✅ No missed references: Confirmed ec-task-policy only appears in this file (lines 30, 79) — the other enterprise-contract references in hack/update-bundles.sh and .github/workflows/push-bundles.yaml are part of the intentional dual-push infrastructure
• ✅ Issue alignment: Change directly matches issue Update stale enterprise-contract reference in hack/update-infra-deployments.sh #1774's proposed fix
• ✅ No security concerns: Registry reference update only, no new functionality or privilege changes

No blocking findings.

---

Labels: PR modifies tooling script in hack/

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
unit-tests	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.