The detect job was checking out main instead of the dispatched ref,
so it couldn't find build files that only exist on feature branches.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The tag field in buildLayeredImage is optional and only affects the
local docker-archive output. The CI workflow tags with immutable
SHA-based tags via skopeo, so "latest" is misleading noise.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace upstream docker.io/library/redis:7-alpine with a nix-built
container using Redis 8.2.3 from nixpkgs. Introduces the attached
service pattern: parent field in service-versions.yaml, naming
convention (<parent>-<component>), and version assertion in default.nix
to prevent silent version drift on flake.lock updates.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
