fix(ci): match digest-pinned image format when updating gitops

The gitops-update sed only matched the old tag-based image reference
(image: ...:SHA). After the digest-pinning fix in nxtgauge-gitops
(release-patch.yaml now uses @sha256:... to stop Flux's
ImageUpdateAutomation from racing this file), the regex silently
matched nothing, git diff showed no change, and every build since
has skipped deploying - the cluster stayed on an old digest despite
CI reporting success. Now captures the pushed image's digest via
buildx's --metadata-file and writes @sha256:<digest> directly.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.forgejo/workflows/build.yaml

@@ -63,18 +63,25 @@ jobs:
         run: |
           set -euo pipefail
           image_ref="$REGISTRY_HOST/ashwin/nxtgauge-ai-assistant:$SHA"
+          metadata_file="/tmp/ai-assistant-metadata.json"
 
           docker buildx build --push \
+            --metadata-file "$metadata_file" \
             -t "$image_ref" \
             -t "$REGISTRY_HOST/ashwin/nxtgauge-ai-assistant:latest" \
             -f Dockerfile \
             .
 
+          digest="$(grep -o '"containerimage\.digest"[[:space:]]*:[[:space:]]*"sha256:[^"]*"' "$metadata_file" | grep -o 'sha256:[^"]*')"
+          test -n "$digest"
+          echo "IMAGE_DIGEST=$digest" >> "$GITHUB_ENV"
+
       - name: Update GitOps
         env:
           GITOPS_REPO: https://ci.nxtgauge.com/ashwin/nxtgauge-gitops.git
           GITOPS_TOKEN: ${{ secrets.GITOPS_TOKEN }}
           SHA: ${{ github.sha }}
+          DIGEST: ${{ env.IMAGE_DIGEST }}
         run: |
           set -euo pipefail
           apk add --no-cache git
@@ -89,13 +96,15 @@ jobs:
           git clone -b main "$GITOPS_REPO" "$GITOPS_DIR"
           cd "$GITOPS_DIR"
 
-          # release-patch.yaml carries a Flux $imagepolicy marker comment on
-          # this line - Flux's own image-automation-controller would
-          # eventually rewrite it too, but committing here makes the new
-          # tag live immediately instead of waiting on Flux's poll interval.
-          sed -i -E "s|(image: ci\.nxtgauge\.com/ashwin/nxtgauge-ai-assistant:)[a-f0-9]+|\1$SHA|" apps/nxtgauge-ai-assistant/overlays/prod/release-patch.yaml
+          # release-patch.yaml pins by digest (@sha256:...), not by mutable
+          # tag - Flux's ImageUpdateAutomation previously raced this file via
+          # a $imagepolicy marker comment and always won because its
+          # alphabetical tag ordering sorted "latest" above any hex SHA,
+          # clobbering this step's commits every ~2 minutes. The marker was
+          # removed from the file so this CI step is now the sole writer.
+          sed -i -E "s#image: ci\.nxtgauge\.com/ashwin/nxtgauge-ai-assistant(:[a-f0-9]+|@sha256:[a-f0-9]+)#image: ci.nxtgauge.com/ashwin/nxtgauge-ai-assistant@${DIGEST}#" apps/nxtgauge-ai-assistant/overlays/prod/release-patch.yaml
 
           git config user.name "forgejo-actions[bot]"
           git config user.email "forgejo-actions@ci.nxtgauge.com"
           git add apps/nxtgauge-ai-assistant/overlays/prod/release-patch.yaml
-          git diff --quiet || (git commit -m "chore(gitops): deploy ai-assistant@${SHA}" && git push)
+          git diff --quiet || (git commit -m "chore(gitops): deploy ai-assistant@${SHA} (${DIGEST})" && git push)