drift: delivery/RULES.md#13 — releases rebuild unchanged images instead of retagging their digests

[elronbandel]

Which rule

• Document: .agents/delivery/RULES.md
• Rule number / section: rule 13 ("Carried-forward images"), with rule 15 ("Gate parity")
• Rule text (pasted verbatim):

13. Carried-forward images. A released image whose build inputs are unchanged from a prior release MUST be retagged from that release's digest rather than rebuilt.

Evidence of drift

• File: .github/workflows/release-images.yml — every build job rebuilds unconditionally. The full chain below the rule exists and is live-proven (hash feat(scripts): fleet-hash — deterministic build-input hashes over the bake graph #298, recording feat(release): stamp eval.input-hash on every pushed image #303, comparison feat(scripts): fleet-status — freshness report over recorded input-hashes #305 — fleet-status read 2 fresh images against real GHCR today), but nothing acts on a fresh verdict: a tagged release rebuilds all ~438 images from scratch, producing different bits for unchanged inputs (builds are not reproducible).
• What the rule demands: unchanged inputs ⇒ retag the prior digest (imagetools create — the mechanism the workflow already uses for :latest promotion).
• What the code does: rebuilds everything; the only skip is the judgment-based skip_published tag-existence check (feat(release): skip_published — incremental re-runs build only missing/failed #227), which cannot satisfy rule 13 (no notion of inputs) and is superseded by the hash.

Expected fix direction

• Update the code to satisfy the rule (this is the default for drift)

Rung 5 (final) of #292's migration path: each build job checks its image's recorded hash at the prior release (:latest, the promoted last release) and retags instead of rebuilding when fresh — in-place inside the existing jobs, never by pruning the matrix (the n<=0 guard and needs.* chain break otherwise). skip_published is deleted; a force_rebuild input covers CVE/base refreshes until external-digest folding lands (rule 11's deferred clause); the CVE gate keeps scanning whatever :TAG points to, carried or fresh (rule 15). Docs page required (a version tag may now carry bits built at an earlier release — consumer-visible).

Scope

• Fleet-wide (many artifacts violate the same rule — bulk fix via sub-agents)