Publish pullable images and a pre-built install for each release #2730

What we're trying to do

We're adding Agent Substrate to Planton's open-source Kubernetes catalog, so a platform engineer can declare it once and have it installed on a cluster. The first product we're building it for already uses Substrate as its agent runtime. Thanks for ate-setup deploy --image-repo/--image-tag: a pre-built install is exactly the path we want to use.

What we ran into

There's nothing published to point that path at. The install docs show images.repo: ghcr.io/agent-substrate/substrate (docs/operator-install.md, docs/examples/substrate-install.yaml), but an anonymous pull is refused (DENIED: requested access to the resource is denied, checked against v0.5.0 today). The same release has no install manifest with its images resolved either. So every install starts with building every image from source: a Go toolchain, ko, a Docker buildx setup for the Rust Envoy module, and a registry to push to.

That pushes each downstream platform to build and host its own copy of the same release. We now publish one for v0.5.0, built with your own ate-setup publish release-images at the exact tag, and we can see at least one other project doing the same (#2638 reports a defect in such a build). Copies of one version built by different people can differ, and users can't easily tell which build they're running when they file an issue here.

What would help

For each release tag:

• the release's images, pullable without credentials, for both linux/amd64 and linux/arm64;
• the install manifests for that release, with those images already pinned by digest, published with the release, so an install needs no checkout and no build;
• the worker images a WorkerPool points at, listed with the release, since no manifest names them.

When that exists, we'll switch the catalog to install your official builds and stop publishing our own.

Related: #79 (Helm charts) would make the published install easier to consume, but even plain manifests per release would remove the build-from-source step for everyone.