fix(workloads): match image index platform digests

[weicao]

What changed

• add optional offline OCI/Docker image-index proofs under the existing registries configuration
• verify each proof against the exact decoded raw bytes before atomically replacing the active configuration snapshot
• match index-parent and platform-manifest digests in either direction using the scheduled Node OS/architecture
• preserve direct digest equality and existing tag/registry-rewrite behavior
• propagate transient Node reads through InstanceSet and Instance status/update reconcilers
• add the Node get permission and document the configuration shape
• validate the candidate registry configuration during hot reload and keep the previous snapshot when the candidate is invalid

Why

Kubernetes runtimes can report an OCI index digest in status.containerStatuses[].imageID while a PodSpec pins the selected platform manifest digest. Strict digest equality then keeps a valid, Ready Pod out of workload ready/available counts and blocks later rolling updates.

The proof is explicit and offline. Missing or invalid proof, wrong parent/child/platform, unscheduled Pods, missing Nodes, and terminating Nodes all fail closed. Reconciliation does not contact a registry or read pull secrets. Pinning the parent index in every artifact pipeline was rejected because runtime reporting direction is not uniform and local sideload pipelines often have only a stable platform-manifest digest.

Proof hashing uses the exact base64-decoded raw index bytes, without JSON reserialization. Descriptors without a platform and unknown/unknown attestations are ignored. Because a Kubernetes Node exposes only OS and architecture, descriptors with non-empty variant, os.version, or os.features are deliberately unusable. Multiple descriptors for one OS/architecture make only that platform unusable; other unique platforms remain available. A proof with no usable platform is rejected.

This also corrects an existing hot-reload bug: the loader previously validated the active registry configuration instead of the candidate. An invalid registry mapping update could therefore replace the active snapshot. Invalid candidate updates are now rejected and the previous complete snapshot remains active.

Closes #10689.

Validation

• current-main focused RED: exact linux/amd64 child vs index parent returned false (0 passed / 1 failed)
• go test -p=1 ./pkg/controllerutil ./pkg/controller/instanceset ./pkg/controller/instance -count=1
• focused proof and four status/update caller matrices
• GOFLAGS=-p=1 make test-fast
• make manifests
• GOTOOLCHAIN=go1.25.10 make lint-fast (0 issues)

[apecloud-bot]

Auto Cherry-pick Instructions

Usage:
  - /nopick: Not auto cherry-pick when PR merged.
  - /pick: release-x.x [release-x.x]: Auto cherry-pick to the specified branch when PR merged.

Example:
  - /nopick
  - /pick release-1.1

CLA Recheck Instructions

Usage:
  - /recheck-cla: Trigger a re-check of CLA status for this pull request.
Example:
  - /recheck-cla