ci: mirror internal image to Beijing registry

[hongzexin]

Summary

Keep image builds owned by the public CHEK codex-lb fork while delegating the Beijing production mirror to the private ops repository, so the VKE prod cluster avoids cross-region GHCR pulls without exposing registry write credentials to a public repository.

Type of change

• chore: / ci: / build: — tooling, CI, packaging

Linked issue: Internal production deployment follow-up; no public issue.

OpenSpec

• This PR includes / updates an OpenSpec change

Change directory: openspec/changes/publish-chek-internal-images/

Changes

• keep the reviewed full-SHA multi-architecture build in GHCR
• send only the full commit SHA and resulting manifest digest to the private ops-bootstrap mirror workflow
• keep VECR write credentials entirely outside the public fork
• rely on the private workflow to verify main-history provenance, source digest, destination absence, and platform parity

Simplicity

• New feature works with repository-owned CI configuration
• No new application setting, README section, or dashboard navigation item

Test plan

actionlint .github/workflows/internal-image.yml
npx --yes @fission-ai/openspec@latest validate publish-chek-internal-images --strict
npx --yes @fission-ai/openspec@latest validate --specs --strict
ruby workflow parse/structure check
git diff --check

Results: workflow lint clean; change valid; 49 specs passed, 0 failed. Private mirror workflow landed in chekdata/ops-bootstrap#2649 before this dispatch was enabled.

Checklist

• Title follows Conventional Commits.
• OpenSpec is updated.
• Relevant validation passed locally.
• Simplicity gates reviewed.
• CHANGELOG was not edited.

[hongzexin]

@codex review

[hongzexin]

@codex review\n\nPlease review current head 7a47f6522f7f70c134a2151529e18ea6daed36bd, including interrupted dual-registry publication recovery.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 7a47f6525b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[hongzexin]

@codex review\n\nPlease review current head e3d89266fd0a69b516445bf0d77b6ef63670c05e. VECR credentials now remain exclusively in the private ops repository.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e3d89266aa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Allow retrying the mirror dispatch after GHCR publication

If the GHCR push succeeds but this repository-dispatch request fails—for example because of a transient GitHub API error or an expired/mis-scoped GH_PAT—rerunning the workflow exits at the existing-tag guard before reaching this step. The affected commit therefore cannot be re-dispatched through this workflow, leaving its Beijing mirror absent even though its immutable source image exists; handle an existing GHCR tag as a recovery path by resolving its digest and reissuing the dispatch without rebuilding or overwriting it.

Useful? React with 👍 / 👎.

[hongzexin]

Closing in favor of the least-privilege private-ops polling mirror in chekdata/ops-bootstrap#2650. The public fork keeps only its already-merged GHCR build workflow and receives no cross-repository or production-registry credentials.