fix: canonicalize release image references

scripts/release-local-gate.mjs

@@ -64,6 +64,21 @@ export function parseRemoteMain(text) {
     return match[1];
 }
 
+export function validateReleaseWorkflowContract(text) {
+    const workflow = String(text);
+    const image = 'ghcr.io/shik3i/koalasync';
+    if (!workflow.includes(`IMAGE: ${image}`)) {
+        throw new Error(`release workflow must define the lowercase canonical image ${image}`);
+    }
+    for (const reference of ['images: ${{ env.IMAGE }}', 'subject-name: ${{ env.IMAGE }}']) {
+        if (!workflow.includes(reference)) throw new Error(`release workflow must use ${reference}`);
+    }
+    if (/ghcr\.io\/\$\{\{\s*github\.repository\s*\}\}/u.test(workflow)) {
+        throw new Error('release workflow must not derive a Docker image from case-preserving github.repository');
+    }
+    return image;
+}
+
 function assertCleanTree() {
     const status = capture('git', ['status', '--porcelain=v1']);
     if (status) throw new Error(`release gate requires a clean working tree:\n${status}`);
@@ -120,6 +135,9 @@ async function smokeRelayImage(image) {
 export async function runReleaseGate({ version, candidate }) {
     assertCleanTree();
     validateReleaseSourceVersion(version, repoRoot);
+    validateReleaseWorkflowContract(fs.readFileSync(
+        path.join(repoRoot, '.github/workflows/release.yml'), 'utf8'
+    ));
     if (!candidate) assertFinalMainChecks();
 
     const lock = JSON.parse(fs.readFileSync(path.join(repoRoot, 'package-lock.json'), 'utf8'));

scripts/release-local-gate.test.mjs

@@ -3,7 +3,8 @@ import {
     linuxGateCommand,
     parseGateArgs,
     parseRemoteMain,
-    playwrightImageFromLock
+    playwrightImageFromLock,
+    validateReleaseWorkflowContract
 } from './release-local-gate.mjs';
 
 describe('local release gate contract', () => {
@@ -28,6 +29,21 @@ describe('local release gate contract', () => {
         expect(() => parseRemoteMain(`${sha}\trefs/heads/not-main`)).toThrow('could not resolve origin main');
     });
 
+    it('requires one lowercase registry image throughout the release workflow', () => {
+        const valid = [
+            'IMAGE: ghcr.io/shik3i/koalasync',
+            'images: ${{ env.IMAGE }}',
+            'subject-name: ${{ env.IMAGE }}'
+        ].join('\n');
+        expect(validateReleaseWorkflowContract(valid)).toBe('ghcr.io/shik3i/koalasync');
+        expect(() => validateReleaseWorkflowContract(valid.replace(
+            'IMAGE: ghcr.io/shik3i/koalasync',
+            'IMAGE: ghcr.io/${{ github.repository }}'
+        ))).toThrow('lowercase canonical image');
+        expect(() => validateReleaseWorkflowContract(`${valid}\n${'ghcr.io/${{ github.repository }}'}`))
+            .toThrow('case-preserving github.repository');
+    });
+
     it('runs the complete CI-equivalent dependency, verify, and browser sequence', () => {
         expect(linuxGateCommand()).toBe([
             'git clone --no-local /src /work',