fix(release): compare host-less image refs on digest alone - #3905

Ports #3905 to `main`. Same fix, same tests, two cherry-picks, no
conflicts.

`main`'s copy of `hack/verify-promoted-packages.sh` was byte-identical
to the buggy one, so the next promotion cut from here fails the way
v1.6.2 just did: `normalized_refs()` gives a host-less ref a repository
equal to its own tag, because `repo="${image%:*}"` is a no-op on a bare
`tag@sha256:...` scalar with neither `/` nor `:` in it.
`hack/lib/image-refs.sh` emits one of those per shape-3 split map,
promotion rewrites exactly those tags, and the check then reports
changed repositories at identical digests. It cost several rounds on
v1.6.2 before the cause was clear, so it is worth not paying twice.

Checked against `main`'s own tree rather than assumed from the 1.6 port.
13 host-less refs, same count as `release-1.6`: 12 pair one-to-one with
a host-bearing ref at an identical digest, and the 13th is
`packages/system/kuberture/values.yaml` (`tag:` only, no `repository:`,
no `registry:`), which is genuinely digest-only and is the case the
comment says must not be dropped.

The narrowing the 1.6 review left open still does not exist here. Of 14
repository-bearing digest maps, exactly one has a slash-free
`repository:` — kube-ovn's `global.images.kubeovn` — and
`global.registry.address` gives it a shape-4 join that keeps its
repository in the compared set. No map anywhere has an empty or
non-string `registry:` sibling. `hack/lib/image-refs.sh` differs from
`release-1.6`'s in comments only: 47 code lines either side and an empty
diff once comments are stripped, same globs and same selectors, so the
refs reaching the verifier are unchanged. Not modified here.

Red phase checked both directions rather than inherited. Reverting the
one line reddens the new split-map case on the digest-set assertion.
Replacing `repo=""` with an outright `continue` for host-less refs flips
which case fails: the split-map one goes green and `rejects a changed
digest carried only by a repository-less image map` reddens at its
exit-status assertion, because the verifier then exits 0 on a genuinely
changed digest. That second direction is the one worth having a test
for, since dropping host-less refs is the obvious-looking fix.

Gate: the four promote bats suites individually green, `shellcheck -x
--shell=sh` clean, `pre-commit` green. No Go, charts or generated files,
so build, vet, test and `make generate` do not apply.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved promoted package validation for image references without
explicit registries or repositories.
* Promotion-only tag changes are now accepted when the image digest
remains unchanged.
  * Digest changes continue to be detected and rejected correctly.

* **Tests**
* Added coverage for split image reference formats and repository-less
image mappings.


<!-- end of auto-generated comment: release notes by coderabbit.ai -->

…VM disks (#4431)

Backport of #3455 to `release-1.6`.

Management etcd on this branch stalls under the VM-heavy suites the same
way main did before #3455: every operator loses its lease in the same
few seconds, and install failed on it in #3550 and #3905. Second commit
widens tenant node-join deadline from 12m to 18m. Most kubernetes suite
failures on 1.6 are workers that get their CSR signed 6-9 minutes after
VMI start and miss the 12m window, the script step already has 40m so
the wider wait fits.

Both commits cherry-picked clean with `-x`.

### Testing

- `make unit-tests` green, POSIX sh sweep clean.
- Real check is E2E on this PR.

```release-note
NONE
```