Automate GHCR image builds for workload-harness

[kellyaa]

Goal

Build and publish container images from this repo to ghcr.io/kagenti/workload-harness/* on tag pushes, pushes to main, and manual dispatch — modeled after rossoctl/cortex's .github/workflows/build.yaml.

Scope (today)

One image: ghcr.io/kagenti/workload-harness/exgentic-a2a-runner, built from exgentic_a2a_runner/Dockerfile. Workflow is matrix-shaped from day one so future images (if a second Dockerfile lands in this repo) plug in as extra matrix entries.

Out of scope: mirroring ghcr.io/exgentic/* agent/benchmark images built in the Exgentic org.

Deliverables

1. .github/workflows/build.yaml — new workflow, cortex-shaped:
   • Triggers: push on tag v*, push on main, workflow_dispatch
   • Permissions: contents: read, packages: write
   • Matrix (image_config): one entry today — { name: exgentic-a2a-runner, context: ./exgentic_a2a_runner, dockerfile: ./exgentic_a2a_runner/Dockerfile }
   • Steps:
     • actions/checkout (pinned by SHA, version comment)
     • docker/setup-qemu-action + docker/setup-buildx-action (pinned by SHA)
     • docker/login-action against ghcr.io using github.actor + GITHUB_TOKEN
     • Tag resolution: on v* tag → tag name; otherwise → <sanitized-branch>-<sha7>
     • docker/metadata-action — apply latest on v*, main pushes, and manual dispatches
     • docker/build-push-action — platforms: linux/amd64,linux/arm64, push: true
   • Concurrency: cancel-in-progress per ref, so rapid pushes don't queue duplicate builds.
2. Update exgentic_a2a_runner/k8s/job.yaml: replace hardcoded ghcr.io/exgentic/runner:latest with ghcr.io/kagenti/workload-harness/exgentic-a2a-runner:latest and note in the README that this tracks main.
3. README addition: short "Container images" section — where images are published, how tags map to refs, how to build locally.
4. Repo settings (one-time, org admin): after first successful publish, make the GHCR package public and link it to this repo.

Notes for reviewers

• All third-party actions pinned by full commit SHA with a version comment — matches cortex convention and OpenSSF Scorecard expectations.
• No Cosign / SBOM / provenance in v1 to keep the first PR small; can layer in later (cortex doesn't sign today either).
• Cortex has a known bug where build-args: is specified twice in its build-push step; the second key wins and silently drops matrix-level build args. We don't need build args for the runner today, so we'll avoid the dual-key pattern to prevent inheriting the bug.

Acceptance

• Workflow runs green on a PR that touches the Dockerfile
• Push to main produces ghcr.io/kagenti/workload-harness/exgentic-a2a-runner:main-<sha7> and :latest
• A v0.0.1 tag push produces :v0.0.1 and :latest
• linux/amd64 and linux/arm64 manifests both present
• k8s/job.yaml pulls the new image successfully in a smoke deploy