Releases publish the envoy-dataplane image - #3252

Part of #3217. The default atenet dataplane runs envoy-dataplane in the router and egress gateways, but releases do not publish it, so a pre-built install has to use --atenet-dataplane=agentgateway or build from source. #2112 dropped it because building Rust under QEMU was slow. #3152 made the Dockerfile cross-compile, so the release job now builds it with buildx and no QEMU.

Released Dockerfile images are an allowlist (releasedDockerfiles) next to the ko allowlist. The release jobs pin BuildKit by digest. Release builds take each Dockerfile image's digest from buildx's --metadata-file, build Dockerfile images before the ko images, ignore DOCKER_BUILD_FLAGS, and label every image with its source, revision and version. With every image a default install deploys now published, the release notes give the install command.

After the first release that includes it, an org owner has to make the new ghcr.io/agent-substrate/substrate/envoy-dataplane package public.

Validation

release.yaml from this branch, run in my fork at 619f0d9 with a throwaway tag v0.0.0-envoytest.1:

• images-dry-run, dispatched with dry_run_images, built all eleven release images cold on ubuntu-latest and passed the platform and digest checks in 11m35s, well inside the 30-minute timeout.
• The tag push run created the draft release. The images job skips itself outside agent-substrate/substrate, as designed.

Earlier, at bbd8614, I ran the same publish locally against a throwaway registry, as the images-dry-run job does:

docker run -d --rm --name ate-release-test -p 5000:5000 \
  registry:3@sha256:ddf754342cfc8acc51a56d5d0ab6af06826461864460636d8bd5c546dab2a7b8
printf '[registry."localhost:5000"]\n  http = true\n' > /tmp/buildkitd.toml
docker buildx create --name ate-release --driver docker-container \
  --driver-opt network=host --buildkitd-config /tmp/buildkitd.toml --use
VERSION=v0.0.0-local.1 KO_DEFAULTPLATFORMS=linux/amd64,linux/arm64 \
  go run ./cmd/ate-setup publish release-images --ko-docker-repo localhost:5000/substrate
docker buildx imagetools inspect localhost:5000/substrate/envoy-dataplane:v0.0.0-local.1
docker buildx imagetools inspect localhost:5000/substrate/envoy-dataplane:v0.0.0-local.1 \
  --format '{{json (index .Image "linux/amd64").Config.Labels}}'

• buildx cross-compiled the Rust module (linux/amd64->arm64), with no QEMU.
• The envoy-dataplane digest from --metadata-file matched what the tag resolved to.
• envoy-dataplane had linux/amd64 and linux/arm64, and the source and revision labels.
• A rerun built nothing.

That run showed envoy-dataplane inheriting org.opencontainers.image.version: "22.04" from the Ubuntu base of envoyproxy/envoy. Release images now set that label to the release tag.

AI use: I used Claude Code to trace the code #2112 removed, draft the change, address review comments, and script the local and fork validation. I reviewed the diff and ran the ate-setup tests and the validation above.

• Tests pass
• Docs updated