Benchmark v2: CI image builds via OIDC to ECR (no local Docker)

[ShimonSte]

Removes the local-Docker dependency from benchmark image builds — DRAFT

Rewires benchmark-images.yml so GitHub Actions builds and pushes all three benchmark images to the ECR the EKS cluster actually pulls from:

• OIDC auth: AssumeRoleWithWebIdentity into the shared CI role (CLICKBENCH_AWS_ROLE_ARN repo secret) → ECR login. Replaces the GHCR/GITHUB_TOKEN path, which pushed to a registry the runtime never used.
• Producer image job added: buildx linux/amd64 from the e2e context, digest-resolved from ECR — same digest-pinning discipline as the arms; new producer_image workflow_call output.
• Registration push trigger: GitHub can't dispatch workflows absent from the default branch; a push touching this file creates a (skipped, job-guarded) run that registers it for workflow_dispatch.

Companion IAM change (applied separately by the operator): CI role trust extended to this repo's benchmark branches + a scoped ECR push policy on connect-bench/producer-bench only.

Context: the 2026-07-13 pair-5 image build was blocked for hours by a workstation Docker Desktop VM network outage — the benchmark should never depend on a laptop to build its images.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Bfy6tmKaAHymcUWu8MtdWC