CI / CI (push) Successful in 5m38s
Root cause: image updater used 'digest' strategy with allow-tags=latest
but 'digest' requires a version constraint. Result: updater errored every
2min cycle and never promoted new images.
Fix:
- Strategy: newest-build (picks most recently pushed tag)
- Allow-tags: regexp:^[a-f0-9]{7}$ (matches 7-char git SHA tags from CI)
- Alias: app (matches ArgoCD app annotation)