Collect images referenced by feature charts and container flags

[ArnobKumarSaha]

Problem

Two kinds of image reached no catalog.

Feature chart images. list-feature-charts records only the chart OCI refs pinned by each Feature/FeatureSet. Nothing ever renders those charts. list --root-dir=charts can't cover them either — in the installer tree the images appear only inside a Feature's spec.values, as maps:

image:
  repository: registry.k8s.io/prometheus-adapter/prometheus-adapter

while collectImages records only string values under a key named image. The tag isn't there at all — it comes from the feature chart's own appVersion.

Flag-passed images. An operator that launches other workloads takes their image as a container flag, and that reference appears nowhere else in the manifest:

--acme-http01-solver-image=ghcr.io/appscode-images/cert-manager-acmesolver:v1.19.3
--prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.80.0
--thanos-default-base-image=quay.io/thanos/thanos:v0.37.2

appscode-cloud/artifacts carried a regex over rendered output to recover the three above; collecting them here retires that.

Fix

Render feature charts. Each at its pinned version, with the values its Feature carries — that's what makes the ACE-specific overrides resolve.

• pkg/lib/feature.go (new) — FeatureChart + FeatureChartImages(), 8 charts concurrently
• pkg/lib/image.go — extracted writeTempValues, added exported CollectRenderedImages
• pkg/cmds/list_feature_charts.go — ListUICharts returns []lib.FeatureChart carrying spec.values, deduped on chart and values

A chart that fails to render is reported by name rather than aborting, so one broken chart can't silently empty the catalog.

Collect flag-passed images. name.ParseReference can't be the test on its own — it defaults the registry to docker.io and the tag to latest, so --log-level=info parses as an image. Demand an explicit registry host and an explicit tag or digest, which an image passed this way always carries.

--exclude-chart. Most feature charts belong to an installer that already publishes its own catalog/imagelist.yaml, so rendering everything makes this file restate images another catalog owns — for appscode-cloud/installer that was 398 of 545 entries. Which charts those are is deployment policy this tool can't know, so the names come from the caller (repeatable, comma-accepting). No ownership is hardcoded here. An exclusion matching no chart is reported, since a stale entry would otherwise silently start collecting images again. feature-charts.yaml is unaffected.

Verification against appscode-cloud/installer

• catalog/imagelist.yaml is byte-identical across all its charts with flag-scanning enabled — the scan adds no false positives.
• feature-charts.yaml output byte-identical.
• With its 65 exclusions: 79 images from 49 charts, a superset of the six images/<chart>.yaml files appscode-cloud/artifacts used to hand-curate, minus only the two flux2 controllers the ACE Feature disables.

Notes for reviewers

• --with-images (default true) turns off the network-heavy render.
• Deliberately not using golang.org/x/sync/errgroup — vendored only as // indirect, so importing it directly would edit go.mod/vendor. A sync.WaitGroup + semaphore does the same job.
• No helm release name is passed to helm template: 5 editor-featureset chart names exceed helm's 53-char release-name limit.
• Digest-only refs are dropped with a warning naming them — generate-scripts derives both the tarball name and destination reference from the tag, so one such ref would fail the whole run. Digest support there is worth a follow-up.
• Deliberately not teaching collectImages about image.repository/image.name maps — it yields untagged refs, so it wouldn't solve this, and would add false positives elsewhere.

Downstream

appscode-cloud/installer#1319, then appscode-cloud/artifacts#4.

Unrelated bug this surfaced

The installer's reloader override is dead code: it writes reloader.deployment.image.name, but appscode-charts/reloader:2.2.9 reads the image from top-level image.repository — that path doesn't exist in the chart's values. So clusters pull ghcr.io/stakater/reloader, not ghcr.io/appscode/reloader. This PR emits what is actually pulled.