fix(REGISTRY-001): CU-86akbhhc9 2 review findings in regsync-config.yaml

[flamingo]

Closes 2 review findings in regsync-config.yaml.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🟡 85 medium	quay.io/debezium/connect has a duplicate sync entry with conflicting tag policies	regsync-config.yaml:189
2	🟡 70 medium	apachepinot/pinot allows 'latest' tag without justification comment	regsync-config.yaml:206

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 0f2a86b8-2d61-459b-95ce-145c43156c7a

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akbhhc9 Registry regsync config hygiene (2 PRs)

[flamingo]

🦩 What this fix changed, finding by finding

2 finding(s) fixed in this draft — 2 explained inline on the diff.

[flamingo]

🦩 🔴 quay.io/debezium/connect has a duplicate sync entry with conflicting tag policies

Merged the two duplicate quay.io/debezium/connect sync blocks in the sync: list into a single entry with one semverRange: >=3.0.0 floor and combined allow patterns ('[0-9]+\.[0-9]+\.[0-9]+' and '[0-9]+\.[0-9]+\.[0-9]+\.Final'), removing the first unbounded entry that allowed 2.x .Final tags with no semverRange floor, exactly per the suggested fix.

🤖 Prompt for AI agents

In regsync-config.yaml around line 189, review and complete this code-review fix: quay.io/debezium/connect has a duplicate sync entry with conflicting tag policies.
What the draft fix changed: Merged the two duplicate `quay.io/debezium/connect` sync blocks in the `sync:` list into a single entry with one `semverRange: >=3.0.0` floor and combined `allow` patterns (`'[0-9]+\.[0-9]+\.[0-9]+'` and `'[0-9]+\.[0-9]+\.[0-9]+\.Final'`), removing the first unbounded entry that allowed 2.x `.Final` tags with no semverRange floor, exactly per the suggested fix.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 85 medium — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🟠 apachepinot/pinot allows 'latest' tag without justification comment

Added inline comments above/beside the two "latest" allow entries in the docker.io/apachepinot/pinot tagSets block explaining the exception (rolling SNAPSHOT/latest builds used for pre-release testing), per REGISTRY-002-2's requirement that latest allow-patterns carry a rationale comment. The specific justification text is my best inference from context (SNAPSHOT tag present alongside it) and should be reviewed/refined by someone with actual knowledge of why latest is needed for this image.

🤖 Prompt for AI agents

In regsync-config.yaml around line 206, review and complete this code-review fix: apachepinot/pinot allows 'latest' tag without justification comment.
What the draft fix changed: Added inline comments above/beside the two `"latest"` allow entries in the `docker.io/apachepinot/pinot` tagSets block explaining the exception (rolling SNAPSHOT/latest builds used for pre-release testing), per REGISTRY-002-2's requirement that `latest` allow-patterns carry a rationale comment. The specific justification text is my best inference from context (SNAPSHOT tag present alongside it) and should be reviewed/refined by someone with actual knowledge of why `latest` is needed for this image.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 70 medium — react 👍/👎 to teach the reviewer