Summary

Switch the UAT evidence push target to a stable, digest-addressed repo-per-recipe layout: the repo path is the recipe identity and the run id moves to a :run-<id> tag.

Motivation / Context

The UAT pipeline baked the CI run_id into the OCI repository name and duplicated recipe-coordinate dims across both the repo and the derived tag, fragmenting evidence across a new GHCR package per run and making it hard to discover, list, or consume.

before: ghcr.io/nvidia/aicr-uat-eks-h100-training-<run_id>:h100-eks-ubuntu-training-kubeflow-<fp12>
after:  ghcr.io/nvidia/aicr-evidence/h100-eks-ubuntu-training-kubeflow:run-<run_id>

This adopts the issue's preferred repo-per-recipe layout, eliminating all four redundancies:

1. run_id no longer in the repo name → one stable package per recipe; oras repo tags lists run history; visibility set once.
2. Coordinate dims no longer duplicated across repo and tag.
3. Non-verifiable 12-hex fingerprint prefix dropped — an explicit tag suppresses aicr's <recipe-slug>-<fingerprint> derivation; consumers pin immutably via @sha256:….
4. The full recipe slug is the single canonical coordinate (the repo path).

The run id is not lost: the bundle predicate carries rekorLogIndex + attestedAt, and the tag preserves CI provenance.

Fixes: #1478
Related: N/A

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactoring (no functional changes)
• Build/CI/tooling

Component(s) Affected

• Other: UAT pipeline (tests/uat/{aws,gcp}, .github/workflows/uat-{aws,gcp}.yaml)

Implementation Notes

• tests/uat/{aws,gcp}/tests/h100-training-config.yaml — push: is now the bare per-recipe repo (matching the canonical overlay names h100-eks-ubuntu-training-kubeflow / h100-gke-cos-training-kubeflow).
• tests/uat/{aws,gcp}/run — inject_push_target applies a :run-${RUN_ID} tag idempotently, stripping any prior :run-… tag first so a re-run (or a changed RUN_ID) in the same workspace does not double-append.
• .github/workflows/uat-{aws,gcp}.yaml — the **Evidence (OCI):** summary echo and surrounding comments reference the new ref.
• An explicit tag is required to suppress aicr's <recipe-slug>-<fingerprint> tag derivation (which only runs when the ref omits a tag); the nested repo path + tag parses cleanly through oci.ParseOutputTarget (docker reference.ParseNormalizedNamed).

Testing

yamllint tests/uat/{aws,gcp}/tests/h100-training-config.yaml .github/workflows/uat-{aws,gcp}.yaml  # clean
bash -n tests/uat/{aws,gcp}/run                                                                    # syntax OK

YAML/shell-only change (no Go sources), so the Go test/lint/coverage gates do not apply. inject_push_target idempotency verified across fresh, repeat, changed-RUN_ID, and local-<ts> forms.

Risk Assessment

• Low — Isolated change to the UAT pipeline, easy to revert.

Rollout notes: First run on the new layout creates the ghcr.io/nvidia/aicr-evidence/<recipe> package; set its visibility once. No consumer pins the old aicr-uat-* packages.

Checklist

• Tests pass locally (make test with -race)
• Linter passes (make lint)
• I did not skip/disable tests to make CI green
• I added/updated tests for new functionality
• I updated docs if user-facing behavior changed
• Changes follow existing patterns in the codebase
• Commits are cryptographically signed (git commit -S)