Fix image_name inference bug + add tag normalization setting (oleks/ci-scripts#21, #22)

render_thin_quartet.py's kind=matrix rendering derived image_name from the
manifest's repo field, which silently diverges from the actually-published
image for xonsh-image (repo "xonsh-image" vs. live image "oleks/xonsh",
confirmed via the package registry). image_name is now a required, explicit
manifest field with no inference; xonsh-image and csi-s3 manifests updated
with their verified values.

entrypoint.sh's buildx-build/buildx-manifest flows always used the raw
CI_COMMIT_TAG, with no way to reproduce ci/local.sh's leading-"v" /
trailing-"-N" tag stripping. Added resolve_version() with two additive,
default-preserving settings: `version` (explicit override, wins over
CI_COMMIT_TAG when set — a no-op today since nothing sets it) and
`tag_strip_v` (opt-in normalization). Default behavior is unchanged: raw
CI_COMMIT_TAG, matching this plugin's own v1.0.x self-build tags and every
other current consumer.

xonsh-image's manifest now opts into tag_strip_v to prove the fix (verified:
resolve_version("v0.22.7") -> "0.22.7", rendered tag "0.22.7-amd64" matches
the live-consumed scheme) but is NOT wired into its actual .woodpecker/ dir
yet — migration is a separate step once both fixes are released.

oleks/ci-scripts#20

generator/render_thin_quartet.py

@@ -31,6 +31,13 @@ than the fleet family's migration (which just moves inline shell into
 `run:`) — needs explicit confirmation that ci/local.sh's Dockerfile build is
 the ONLY thing it does before this ships (see report).
 
+`kind: matrix` manifests must set `image_name:` explicitly, verified against
+the live Gitea package registry (oleks/ci-scripts#22). It is NEVER inferred
+from the manifest's `repo:`/dir field — `xonsh-image`'s repo field and its
+actually-published image (`oleks/xonsh`, confirmed live) genuinely differ;
+inferring one from the other silently pushes a migrated pipeline to a
+different, wrong (and possibly empty) image path.
+
 For the-eye/emdash (single) and flake-hub/woodpecker-peek (split), the
 existing pipelines already invoke a repo-owned script (`ci/local.sh`,
 `nix run .#publish-*`) as their entire build logic — same shape as the fleet
@@ -92,6 +99,13 @@ def render_build(manifest: dict, arch: str, image_name: str) -> str:
             + lines
             + "\n"
         )
+    # oleks/ci-scripts#21: opt-in only — reproduces a repo's own ci/local.sh
+    # tag normalization (strip leading "v" + trailing "-N"). Default off
+    # (entrypoint.sh's resolve_version() default matches today's raw-tag
+    # behavior), set per-manifest via `tag_strip_v: true`.
+    tag_strip_v_line = (
+        '      tag_strip_v: "true"\n' if manifest.get("tag_strip_v") else ""
+    )
 
     return f"""{GENERATED_HEADER}labels:
   arch: {arch}
@@ -110,11 +124,14 @@ steps:
       flow: buildx-build
       image_name: "{image_name}"
       tag_scheme: "{{version}}-{{arch}}"
-{backend_options_block}"""
+{tag_strip_v_line}{backend_options_block}"""
 
 
 def render_manifest(manifest: dict, arches: list, image_name: str) -> str:
     platforms = ",".join(arches)
+    tag_strip_v_line = (
+        '      tag_strip_v: "true"\n' if manifest.get("tag_strip_v") else ""
+    )
     return f"""{GENERATED_HEADER}when:
   - event: tag
     ref: "refs/tags/v*"
@@ -140,7 +157,7 @@ steps:
       image_name: "{image_name}"
       platforms: "{platforms}"
       tag_scheme: "{{version}}-{{arch}}"
-"""
+{tag_strip_v_line}"""
 
 
 def _comment_block(text: str, indent: str) -> str:
@@ -289,7 +306,19 @@ def main():
         out_dir = args.out / repo
 
         if kind == "matrix":
-            image_name = f"git.oleks.space/oleks/{repo}"
+            # oleks/ci-scripts#22: image_name must be explicit in the
+            # manifest, never inferred from the repo/dir name — the two
+            # silently diverge for xonsh-image (repo field "xonsh-image",
+            # actually-published image "oleks/xonsh") and inference would
+            # have pushed a migrated pipeline to an empty, wrong image path.
+            image_name = manifest.get("image_name")
+            if not image_name:
+                raise SystemExit(
+                    f"manifest for {repo!r} (kind=matrix) is missing required "
+                    "'image_name' field (oleks/ci-scripts#22: must be explicit, "
+                    "verified against the live package registry — do not infer "
+                    "it from the repo/dir name)"
+                )
             arches = manifest["arches"]
             out_dir.mkdir(parents=True, exist_ok=True)
             for arch in arches: