feat: automatic image updates via OCI registry digest polling

[stubbi]

Summary

Adds automatic image update support to the operator. When enabled, the operator periodically polls the container registry for new image digests and triggers rolling updates automatically.

Usage

spec:
  image:
    repository: ghcr.io/paperclipinc/paperclip
    tag: latest
    autoUpdate:
      enabled: true
      interval: 5m

When a new image is pushed to ghcr.io/paperclipinc/paperclip:latest, the operator detects the digest change within the polling interval and triggers a rolling restart of the StatefulSet.

How it works

1. Operator polls the registry via OCI Distribution API (HEAD /v2/{name}/manifests/{tag})
2. Compares the Docker-Content-Digest header against the last known digest
3. When changed, writes the new digest as a pod template annotation (paperclip.inc/resolved-digest)
4. StatefulSet controller detects the annotation change and triggers a rolling update

Implementation

• CRD: AutoUpdateSpec (enabled, interval) on ImageSpec, AutoUpdateStatus on InstanceStatus
• Registry client (internal/registry): OCI registry client with bearer token auth flow, supports GHCR, Docker Hub, and private registries via imagePullSecrets
• Reconciler: reconcileAutoUpdate method using requeue-based polling (leader-election safe, no background goroutines)
• Rollout trigger: Pod annotation injection (same mechanism as kubectl rollout restart)

Test plan

• 11 new unit tests (registry client: anonymous, bearer auth, credentials, errors, parsing; StatefulSet annotation injection)
• All 34 tests pass
• Lint clean (golangci-lint)
• Manual: deploy with autoUpdate enabled, push new image, verify rollout

🤖 Generated with Claude Code