[Unique-Divine]

Publish the upstream-compatible Nibiru Cosmopilot distribution

Publish Nibiru-owned operator images and optional Helm charts on top of the upstream v2.2.1 baseline merged in #341. Mainnet adoption is tracked in NibiruChain/iac#2828. Mainnet can then use our distribution without changing its Kubernetes API.

Rationale

The existing org distribution uses apps.k8s.nibiru.org/v1, while mainnet already uses upstream cosmopilot.voluzi.com/v1. This branch retains the upstream API, Go module path, and operator behavior. Nibiru-specific publication changes are separate from the upstream history and the later compatible-patch feature.

Key Changes

1. Default the operator image and local builds to ghcr.io/nibiruchain/cosmopilot. Keep upstream companion image versions.
2. Grant chart publication package write permission and derive chart/app versions from the exact triggering chart tag, so unrelated tags cannot select an image version.
3. Repair inherited companion-image publishing workflows by updating metadata actions and using the actual nested build matrix platform.
4. Document distinct Nibiru release tags, upstream tag handling, and the mainnet adoption order.

1 - Distribution and deployment

upstream v2.2.1 history -> org distribution -> v2.2.1-nibiru.1 image
                                          -> chart/v2.2.1-nibiru.1 chart
                                          -> reviewed mainnet IaC switch

This PR does not implement scoped patches or clear the snapshot overrides. Those changes need separate behavior tests and an operator release.

The chart packages, lints, and renders locally with ghcr.io/nibiruchain/cosmopilot:2.2.1-nibiru.1 and the existing API. All 43 integration specs and the upstream unit suite pass. Actionlint passes on the changed chart publisher, and Actions schema checks pass across all workflows. Other imported publisher scripts retain existing ShellCheck style warnings.

Main has been merged into this branch with git_mf main. IaC can retain its upstream chart and override image and imageTag; an org chart is optional. A patch adding CRD fields will still require updated CRD definitions. Publish and verify the operator image before deploying it. No mainnet deployment or patch release tag is part of this PR.