fix(dev): harden docker-desktop image delivery, drop broken --no-workers (#517, #518, #519)

[ericfitz]

Three follow-ups from the Docker Desktop dev-target work (#520), all in the dev-tooling layer (scripts/lib/deploy.py + dev k8s overlays). No production/Go code, no DB schema.

#517 — pre-import postgres/redis to avoid first-run cgr.dev flake

Docker Desktop's containerd pulls cgr.dev/chainguard/{postgres,redis} independently of the host Docker daemon; that first pull occasionally fails with a transient EOF, leaving pods in ErrImagePull.

• build_and_push now docker pulls the base images on the host and imports them into the node's containerd alongside the tmi-* images.
• Postgres/redis manifests pinned to imagePullPolicy: IfNotPresent so the imported copy is used (a :latest tag otherwise defaults to Always and re-pulls, defeating the import). Redis pin is a per-overlay kustomize patch because redis.yml is shared with k3s (which remaps redis to redis:7-alpine); postgres is pinned directly in docker-desktop/postgres.yml (applied raw by deploy.py).
• Base-image set is DB-aware: oracle uses external ADB and deploys no Postgres pod, so only redis is imported there.

#518 — remove the broken --no-workers path

It applied raw leaf manifests (image: localhost:5000/tmi-*:dev) that only worked against the retired kind local registry — ErrImagePull on docker-desktop/k3s. No make target passed it (developer-manual-only dead code). Removed the flag, the no_workers params on start/restart/apply_overlay, and _no_workers_files.

#519 — harden import_image_to_node against a pipe hang

If the importer Popen raised before saver.stdout.close(), the parent kept the pipe's read end open and saver.wait() could deadlock once the buffer filled. The importer Popen is now wrapped so saver's stdout is released (and saver killed) on any exception before the wait.

Verification

• make test-dev-scripts — 94 pass (added tests for DB-aware base-image selection and the import teardown path; removed the --no-workers tests).
• make lint — pass.
• kubectl kustomize renders IfNotPresent on redis across all three docker-desktop overlays; k3s unaffected.
• ⚠️ The runtime behavior of dev(docker-desktop): pre-import postgres/redis images to avoid first-run cgr.dev pull flake #517 (actually dodging the cgr.dev flake) can only be confirmed with a live make dev-up CLUSTER=docker-desktop on a fresh node.

Closes #517
Closes #518
Closes #519

🤖 Generated with Claude Code