fix(kind): pull the published harness image by default (#154)

[pdettori]

What

deploy/knative/setup-kind.sh now pulls the published harness image by default and loads it into the kind cluster, instead of building it locally on every run. If the pull is unavailable (offline, or image missing) it transparently falls back to a local build.

Why (#154)

Issue #154 reported that a first-time ./deploy/knative/setup-kind.sh failed during the local Docker build. The build failure itself was the non-hermetic pi-fork codegen and is already fixed on main by #161 (hermetic build; identical root cause to #160).

The second point in #154 — "I didn't expect a first-time quickstart to build the image; --skip-build works around it, should we default to that?" — is what this PR addresses. Rather than default to --skip-build (which requires the user to pre-load an image), the script now does the load for them:

flowchart TD
    S["setup-kind.sh (step 7)"] --> Q{"flag?"}
    Q -->|"--skip-build"| K["reuse preloaded dev.local tag"]
    Q -->|"--build"| B["docker build --load → kind load"]
    Q -->|"default"| P["docker pull ghcr.io/rossoctl/serverless-harness:latest"]
    P -->|success| T["tag dev.local → kind load"]
    P -->|"pull unavailable"| B

Loading

The published image ghcr.io/rossoctl/serverless-harness:latest is a public GHCR package (anonymously pullable), so this works for first-time users with no auth. The pull path is also inherently immune to source-build breakage, since it uses a pre-built artifact.

Behavior

Invocation	Harness image
(default)	pull published image → fall back to local build if unavailable
--build (FORCE_BUILD=1)	always build from this checkout (for local source changes)
--skip-build	reuse a preloaded dev.local/serverless-harness:local (unchanged)
--image <ref> / SH_IMAGE=<ref>	override the pulled image

Non-regressing: devs testing local changes use --build; the new-Revision build-ts stamp now fires whenever an image is (re)loaded (pull or build), not only on build.

Tests

Image provisioning is extracted into ensure_harness_image() behind a SH_SOURCE_ONLY guard so it is unit-testable without a cluster. New deploy/knative/tests/setup-kind-image.test.sh mocks docker/kind and asserts the four decision paths (pull-success, pull-fail→build, force-build, skip). shellcheck clean.

Docs

README-kind.md and serverless-harness-demo.md updated for the new default and the --build escape hatch.

Follow-up (not in this PR)

build.yaml still hardcodes the publish target as ghcr.io/kagenti/… (currently not anonymously pullable) while the public image lives under ghcr.io/rossoctl/… post org-rename. Worth reconciling the publish namespace so latest stays fresh — tracked separately.

Refs #154

Assisted-By: Claude Code