refactor: image profiles as a registry instead of duplicated strings

[lroolle]

Description

Adding an image profile means editing the same identity in 6+ places. Make the profile table data; derive everything else.

Type

• Enhancement

Details

Today a profile's identity is duplicated across:

• deva.sh validate_profile case list
• deva.sh check_image fallback tag order (hand-ordered cloak rust latest)
• deva.sh check_image build-hint case
• Makefile: TAG / IMAGE / DOCKERFILE / BUILD_ARGS / build-x / test-x / buildx-multi-x / .PHONY / help
• .github/workflows/release.yml (a ~50-line near-copy job per profile)
• a per-profile CI workflow

Nothing declares that cloak extends rust extends base. The fallback order is hand-maintained instead of falling out of the lineage.

The repo already uses this pattern twice -- TOOL_REGISTRY in scripts/release-utils.sh and VERSION_PIN_VARS in scripts/version-pins.sh. Profiles just never got converted.

Proposed scripts/image-profiles.sh, one row per profile:

name | dockerfile | parent | tag | nightly | release-policy | build-args-var

Then:

• validate_profile reads names from the registry; check_image's fallback order derives from the parent chain (child before parent) instead of a hand-written list
• Makefile generates build-/test-/buildx-multi- targets per profile via define/eval + foreach
• release.yml builds a job matrix from the registry; release-policy (gating|optional|skip) decides continue-on-error and whether the release job needs it
• make profiles / deva.sh -p list prints the table -- discoverability for free

This also gives the cloak decision a home in data rather than a comment: cloak is nightly=skip, release=optional because it holds no agent CLIs (see #456).

Known design limit to decide explicitly: base/rust is a toolchain axis, cloak is a capability axis, but the chain is linear -- so cloak implies rust and "base + cloak" is unbuildable. Fine today (cloak needs rust's Chromium deps), but worth stating so it is a choice rather than an accident.

Related Files

• deva.sh (validate_profile, check_image)
• Makefile
• .github/workflows/release.yml, cloak-image.yml, nightly-images.yml
• scripts/image-profiles.sh (new)

Test Plan

• Registry round-trip test: every profile in the registry has a Dockerfile and resolvable parent
• deva.sh -p <each> resolves the same tag as before the refactor
• Fallback order derived from lineage matches the current hand-written order
• Adding a throwaway profile touches only the registry + its Dockerfile