Adapts to kagent-dev#2242 (declarative agents referenced by tag, digests only for
sandbox agents):
- DefaultGoImageConfig defaults to ghcr.io/kagent-dev/kagent/golang-adk
  and now carries a Tag (regular Go agents are tag-referenced)
- resolveRuntimeImage takes the tag as a parameter so the Go runtime
  resolves via DefaultGoImageConfig.Tag
- new --go-image-tag flag, controller.goAgentImage.tag Helm value and
  GO_IMAGE_TAG ConfigMap key (coalesced with global tag / Chart version)
- tests updated from digest to tag expectations; drops the upstream
  derivation test superseded by explicit Go image config

…r sandbox agents (#2242) (#2266)

## Description

Backport of #2242 (`807c5689`) to `release/v0.9.x`.

Fixes #2055 on 0.9.x (mirrored registries that re-assign manifest
digests could not resolve the link-time digest refs).

## Differences from #2242

`release/v0.9.x` predates the Python `-full` runtime variant
(`PythonADKFullImageDigest` / `APP_FULL_IMAGE_TAG` do not exist on this
branch), so:

- `resolvePythonRuntimeImage` gains only the `pinDigest` parameter — no
`full` parameter. The `full := runtime == Go && needsSRTSettings(...)`
computation stays Go-only, as on this branch.
- Three digest-override flags added instead of main's four:
`--app-image-digest`, `--golang-adk-image-digest`,
`--golang-adk-full-image-digest` (env: `APP_IMAGE_DIGEST`, etc.).
`--app-full-image-digest` is dropped with the variant it targets.
- New unit tests adapted to the two-arg Python signature and this
branch's default registry (`cr.kagent.dev`; main's tests use `ghcr.io`).
- The golden files were regenerated with `UPDATE_GOLDEN=true` rather
than hand-merged: each changes `app@sha256:test-app` → `app:dev`,
matching the shape of the change on main.

Additionally, digest pinning is gated on the substrate platform rather
than on sandbox workload mode. On main every `SandboxAgent` is a
substrate agent (no `spec.platform` field), so the workload-mode gate is
equivalent there; this branch also has the agent-sandbox platform, which
accepts tag refs. Pinning those by digest would have kept the
mirrored-registry breakage for them. Sandbox agents on the agent-sandbox
platform now get tag refs like regular agents; only substrate sandbox
agents pin by digest.

---------

Signed-off-by: Jeremy Alvis <[email protected]>

…figurable (#2021)

Fixes #2018.

## What

Adds `DefaultGoImageConfig` (registry, repository, tag, pullPolicy) so
the Go (ADK) runtime agent image is configured independently instead of
being derived from the Python repository by string surgery. Exposed
end-to-end as:

- `--go-image-{registry,repository,tag,pull-policy}` controller flags
(auto-mapped to `GO_IMAGE_*` env vars via `LoadFromEnv`)
- `controller.goAgentImage.{registry,repository,tag,pullPolicy}` Helm
values
- `GO_IMAGE_*` ConfigMap keys, following the same defaulting as
`agentImage`/`skillsInitImage` (registry/pullPolicy default to the
globals, tag coalesces with the global tag then the Chart version)

Defaults are encoded in the variable
(`ghcr.io/kagent-dev/kagent/golang-adk`), matching `DefaultImageConfig`
and `DefaultSkillsInitImageConfig`. Since #2242, regular declarative
agents reference the image by tag; sandbox agents still pin by digest
via `GoADKImageDigest` / `GoADKFullImageDigest`. The `-full` variant
selection is unchanged for both paths.

## Why

When `spec.declarative.runtime: go` is used, the controller derived the
Go runtime repository from the Python repository by replacing the last
path segment with `golang-adk`. This breaks for flat-name registry
layouts (e.g. a mirrored registry where the image is
`my-registry.io/kagent-golang-adk`, which the derivation cannot
produce).

## Breaking change

Operators who mirror images and only set `agentImage` no longer get a
derived Go image location; they must set `controller.goAgentImage` as
well. The controller logs a startup warning when the two registries
differ so a misconfigured mirror is visible before a Go agent fails to
pull. As discussed in the review thread, this targets a minor release
(0.10.x).

## Files changed

| File | Change |
|------|--------|
| `go/core/internal/controller/translator/agent/adk_api_translator.go` |
`DefaultGoImageConfig` with encoded defaults |
| `go/core/internal/controller/translator/agent/deployments.go` | Go
image resolution via `DefaultGoImageConfig`; tag threaded through
`resolveRuntimeImage` |
| `go/core/pkg/app/app.go` | four `--go-image-*` flags +
registry-mismatch startup warning |
| `helm/kagent/values.yaml` | `controller.goAgentImage` block |
| `helm/kagent/templates/controller-configmap.yaml` | `GO_IMAGE_*` keys
|
| `go/core/internal/controller/translator/agent/runtime_test.go`,
`imageconfig_test.go` | tests updated to tag-based expectations |

---------

Signed-off-by: QuentinBisson <[email protected]>
Co-authored-by: Eitan Yarmush <[email protected]>
Co-authored-by: Jet Chiang <[email protected]>
Co-authored-by: Peter Jausovec <[email protected]>