fix(#341): refresh the dev pin to current :main; document a docker-less digest lookup

The pin in this PR was read 18 days ago. :main has moved five builds since, and
dev has been hand-pinned twice in the meantime to keep up — most recently to
sha256:f9be5dae (git_sha 19b3c70, current main tip), which is what the live
deployment and both serving pods run right now.

Merging the stale sha256:1b0f133f would have made git disagree with the cluster
and silently rolled dev back 18 days on the next `kubectl apply` — the same
class of drift this PR exists to prevent, just slower. Re-read the digest from
the registry and pin what dev actually runs, so the merge is a no-op against the
live deployment.

Also document the registry-v2 fallback for reading a digest. The `imagetools
inspect` line assumes a docker CLI, which a JupyterLab session doesn't have, and
the GHCR packages API needs a read:packages scope our gh logins generally lack —
so the documented step was not executable from the environment the rollout often
gets driven from. The curl form works anywhere, with a note to validate it
against prod's existing pin before trusting it.

Author: cboettig

AGENTS.md

@@ -107,6 +107,22 @@ disagree, the digest wins). **Never apply prod while the manifest points at an i
 hasn't built yet** — the rollout stalls on `ImagePullBackOff`. `kubectl apply` must precede
 `rollout restart`; a git push alone does not update the cluster.
 
+**No `docker` CLI (e.g. a JupyterLab session)?** `imagetools inspect` needs it, and the
+GHCR packages API needs a `read:packages` token most of our `gh` logins don't carry. An
+anonymous pull token against the registry v2 API works anywhere `curl` does — substitute
+`main` or `vX.Y.Z` for `<tag>`:
+```
+repo=boettiger-lab/mcp-data-server
+tok=$(curl -s "https://ghcr.io/token?scope=repository:$repo:pull" \
+      | python3 -c "import sys,json;print(json.load(sys.stdin)['token'])")
+curl -sI -H "Authorization: Bearer $tok" \
+  -H "Accept: application/vnd.oci.image.index.v1+json" \
+  -H "Accept: application/vnd.docker.distribution.manifest.v2+json" \
+  "https://ghcr.io/v2/$repo/manifests/<tag>" | grep -i '^docker-content-digest:'
+```
+Sanity-check the method before trusting it: run it on the tag prod already pins and
+confirm the digest matches `k8s/deployment.yaml`.
+
 **Verify all replicas converge on a single digest after rollout** (both dev and prod —
 dev is the multi-replica canary, so its convergence matters as much as prod's). Swap the
 label for the deployment you rolled (`duckdb-mcp` for prod, `dev-duckdb-mcp` for dev):

k8s/dev-deployment.yaml

@@ -32,7 +32,7 @@ spec:
         # dev's ≥2 replicas exist to catch. Bump this digest on redeploy (see
         # AGENTS.md → Rollout workflow). The tag prefix is for humans; the digest
         # is enforced. See issue #341.
-        image: ghcr.io/boettiger-lab/mcp-data-server:main@sha256:1b0f133f4c7684b4a3271f627bb0fd4a494da3e056f1b6adf0cff68f85371f4f
+        image: ghcr.io/boettiger-lab/mcp-data-server:main@sha256:f9be5daeb9af3d96dc77a10d78c557e911c687d5091b1e513eb8b6068b048144
         imagePullPolicy: IfNotPresent
         env:
         - name: STAC_CATALOG_URL