Add production-ready container image release advisor

[DevOpsAIguru123]

Summary

Adds the reusable, safe-by-default distribution of the container image release advisor. The production branch contains hardened sample assets only; the intentionally vulnerable findings demonstration remains isolated in PR #74.

Production distribution changes

• locks both Claude and ADK workflows to the hardened Dockerfile
• adds a non-root, read-only, capability-dropped Kubernetes deployment template
• removes deployable intentionally vulnerable Dockerfiles and manifests
• retains fail-closed coverage with synthetic deterministic policy tests
• preserves SonarQube, Trivy config/image/secret scans, policy gates, three reports, advisory triage, protected approval, delivery, and conditional publishing
• documents the isolated blocked-run evidence without making it part of the release branch

Validation

• ADK unit tests: 36 passed
• Claude adapter tests: 19 passed
• policy/config fail-closed tests: 6 passed
• workflow YAML and evaluation JSON parsed successfully
• git diff check passed

Demonstration evidence

• Intentionally vulnerable demonstration: Demo: block an intentionally vulnerable container release #74
• Blocked Actions run: https://github.com/DevOpsAIguru123/awesome-agentic-devops/actions/runs/30571416613

The AI advisor remains non-authoritative. Deterministic policy and protected human approval control publishing.

[sonarqubecloud]

Quality Gate failed

Failed conditions
E Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[sonarqubecloud]

Quality Gate passed

Issues
8 New issues
0 Accepted issues

Measures
0 Security Hotspots
86.6% Coverage on New Code
1.0% Duplication on New Code

See analysis details on SonarQube Cloud

[DevOpsAIguru123]

Production validation completed successfully: https://github.com/DevOpsAIguru123/awesome-agentic-devops/actions/runs/30576496136

• SonarCloud Quality Gate: passed (security rating and coverage gate)
• Hardened Trivy configuration scan: passed
• Local image build plus Trivy vulnerability/secret scan: passed deterministic policy
• Claude Sonnet 5 advisory: completed and remained non-authoritative
• Consolidated reports and delivery: passed
• Approval and publishing: correctly skipped on the pull request