[simonjcarr]

Summary

• add a first-class release-please bundle component and publish customer bundle assets from bundle releases
• resolve digest-pinned web, ingest, and ansible-api image refs from same-run builds or released version tags
• update install/upgrade scripts and docs so customer bundles track bundle releases and refresh ANSIBLE_API_IMAGE

Validation

• bash -n install.sh deploy/customer-bundle/upgrade.sh deploy/customer-bundle/start.sh deploy/scripts/test-install.sh deploy/scripts/test-upgrade.sh deploy/scripts/test-agent-release-bundle.sh
• bash deploy/scripts/test-agent-release-bundle.sh
• bash deploy/scripts/test-install.sh
• bash deploy/scripts/test-upgrade.sh
• bash deploy/scripts/test-agent-release-password-manager-image-ref.sh
• bash deploy/scripts/test-password-manager-compose.sh
• bash deploy/scripts/test-password-manager-release-contract.sh
• bash deploy/scripts/test-password-manager-nginx.sh
• bash deploy/scripts/test-password-manager-startup.sh
• bash deploy/scripts/test-start.sh
• bash deploy/scripts/test-ansible-profile-wiring.sh
• bash deploy/scripts/test-web-entrypoint.sh
• bash deploy/scripts/test-support-data.sh
• bash deploy/scripts/test-start-restart-port-check.sh
• python3 -m json.tool release-please-config.json
• python3 -m json.tool .release-please-manifest.json
• ruby YAML parse for changed workflows
• local docker compose render confirmed all bundled images are digest-pinned

Note: actionlint and shellcheck were not installed locally.