[BRE-1907] Add artifact manifest to build.yml

[gitclonebrian]

🎟️ Tracking

BRE-1907

📔 Objective

This PR is one of 3 across the server, deploy, and devops repos. The overall goal of these is to provide the final deployment workflow in devops with the SHAs of the images that need to be deployed. The current logic uses image tags in the deploy workflow, which are mutable. Deploying using the immutable SHAs from the build step ensures the intended images are deployed.

This PR adds steps to .github/workflows/build.yml that builds and uploads a manifest as an artifact to the run. The manifest contains digests of all the container images built in the run so that downstream workflows can use a given build.yml run's ID as a key to retrieve and deploy the exact images built in that run. The manifest follows the standard outlined in this action.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 61.36%. Comparing base (4c49e19) to head (eb02883).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7920      +/-   ##
==========================================
- Coverage   61.36%   61.36%   -0.01%     
==========================================
  Files        2244     2244              
  Lines       98776    98776              
  Branches     8928     8928              
==========================================
- Hits        60617    60616       -1     
- Misses      36014    36015       +1     
  Partials     2145     2145              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

This PR adds an image manifest to .github/workflows/build.yml. Each matrix leg of build-artifacts now emits a per-image JSON fragment (name, registry, image, tag, digest) and uploads it as an artifact; a new image-manifest job downloads all fragments, combines them with jq, and publishes an aggregate manifest via bitwarden/gh-actions/artifact-manifest. The trigger-k8s-deploy job gains a dependency on image-manifest so deploys can key off immutable digests. New third-party actions are SHA-pinned, and the bitwarden/gh-actions/*@main reference matches the existing convention in this file.

Code Review Details

No blocking findings. The fragment filenames are keyed on unique project names (safe under merge-multiple: true), the combine step is guarded upstream by if-no-files-found: error plus the needs: build-artifacts success requirement, and _AZ_REGISTRY resolves from the workflow-level env. Note the hold label is applied — this is one of three coordinated PRs (server/deploy/devops) and should not merge until the others are ready.