fix(011): drop explicit manifest check, trust mikebom release contract

[mlieberman85]

Summary

The cumulative debug journey across #20/#21/#22/#23 established that explicit ghcr.io manifest verification is infeasible without a cross-org PAT. Each method hit the same underlying wall:

PR	Method	Failure
#20	docker manifest inspect (no auth)	401 unauthorized — ghcr.io v2 requires SOME token
#21	docker manifest inspect (GITHUB_TOKEN auth)	401 denied — token has no cross-org scope
#22	crane manifest	Same as #21 in a different wrapper. My "verified locally" claim was a false positive — I had stale ghcr.io creds in my Docker config
#23	gh api /orgs/.../packages/container/.../versions	Silent empty response — GITHUB_TOKEN's packages: read scope doesn't map to REST-API cross-org container-metadata reads

Every path back to strict verification requires storing a cross-org PAT as a repo secret. That's a real ongoing cost (rotation, principle of least privilege, another attack surface) for a check that:

1. Duplicates mikebom's release contract — their release.yml publishes the GitHub release AND pushes the multi-arch image atomically. If the release exists, the image exists (within seconds).
2. Covers a tiny race window — seconds between release publish and image push. The next nightly (or maintainer dispatch) picks it up cleanly.
3. Has the same failure mode as skipping — if the release-and-image contract is ever broken, users hit ImagePullBackOff at Job-spawn regardless of what we check workflow-side.

Fix

• Drop the manifest check in nightly-detect.sh.
• Contract explicitly documents the design decision and the removed noop_manifest_pending variant. References the hotfix chain (fix(011): manifest-check failure is a soft noop, not a hard fail #20 → fix(011): image existence check via GitHub packages API (drop crane) #23) so future readers understand the reasoning.
• If we ever want strict verification back, the runbook + contract point at the cross-org PAT approach.

Test plan

• CI passes (Rust, helm, shellcheck, SHA-pin discipline)
• Kusari Inspector: no new findings
• Post-merge dry-run: decision=should_bump, current_pin=v0.1.0-alpha.57, latest_mikebom=v0.1.0-alpha.58, next_operator_tag=v0.1.0-alpha.2. Zero side effects (dry-run branch prints "would push", "would open PR").
• If dry-run finally clean, next step is to run without dry_run=true and exercise the real end-to-end pipeline.

🤖 Generated with Claude Code