[vcauesantos]

What happened

loft-sh/github-actions#347 adds the delete-previous-head-image action. It deletes the head image a new push replaces in GHCR. We needed proof that it deletes a real signed image and keeps everything else, before candy uses it.

What this PR changes

A caller workflow that runs the action against real GHCR images. It pushes two signed test heads with different content and a signed release, then runs the action in record and delete mode. The check script confirms the old head's versions are gone. It also confirms head and the release still pull on both architectures and pass cosign verify. A second delete with the same digest must change nothing.

A second job covers a platform shared with a release. The release signs its amd64 manifest on its own, and the old head reuses that manifest. After the delete, the old head and its signature must be gone. The shared manifest, its sha256-<digest> signature tag and cosign verify on it must still work. This is the case from the #347 review.

It pins the released delete-previous-head-image/v1 tag. The earlier runs used the PR branch commit. This run checks the tag callers will use, including the review fixes.

How it was tested

• Run 41729014649 (PR branch code): 8 versions deleted, head and v0.0.1 pull and verify, the repeat delete was a no-op.
• Run 42079889490 (v1 tag): the same checks passed.
• Run 42082465256 (v1 tag, both jobs): passed. The shared-platform job deleted the old head index and its signature (3 versions) and kept the shared amd64 manifest, its signature index and signature (3 versions, "also part of tag v0.0.2"). cosign verify passed on the shared manifest and on the release.

Related to DEVOPS-1807

[vcauesantos]

Throwaway test for loft-sh/github-actions#347. Runs 41729014649, 42079889490 and 42082465256 proved the action against real GHCR images; not merging.