Complete GitOps rendering against the promotable plugin contract

[AntoineToussaint]

Problem

PR #155 closed #152, but current main does not compose with the contracts that #152 depended on:

• go.mod pins Core at pre-profile commit e971e885abd6, so GitOps rendering cannot request or verify the promotable output profile from Define a secret-free restricted Kubernetes manifest contract for official plugins core#101.
• Render validation applies URL parsing to every scalar string. The official image placeholder image:tag is therefore interpreted as an unsafe URL scheme.
• RenderModule copies the complete module deployment/kustomize tree, including unrelated environment overlays, instead of installing only the selected environment bootstrap.
• CLI output is installed under deployments/environments//modules/, while module-saas-starter#30 validates and generates Applications for deployments/modules//services//overlays/.
• Publication does not hand an immutable reviewed service snapshot to the module generator before Applications are generated.

Reproduction from codefly-dev/mind#216 at Mind main c35f86dd with current official plugin pins:

codefly deploy gitops render users --env local --app-project mind-server-users-local

The command fails with:

services/accounts/overlays/local/kustomization.yaml: images.[0].name contains unsafe URL scheme "image"

A diagnostic service render also proves current go-grpc output contains an unowned Namespace and Kubernetes Secret, which the module generator must reject.

Acceptance criteria

• Pin the released Core profile contract from Release the promotable Kubernetes manifest contract core#103.
• Request PROMOTABLE_GITOPS_V1 for every GitOps render, including local Argo qualification; reserve EPHEMERAL_LOCAL_APPLY_V1 for verified direct local apply.
• Pass typed secret references, never secret bytes, and reject a plugin response whose returned profile differs from the request.
• Apply URL validation only to URL-bearing fields; accept valid OCI image references and Kustomize image selectors.
• Render and inventory only the selected environment bootstrap plus its exact module service graph.
• Align the CLI-owned service snapshot path with module-saas-starter#30.
• Publish the immutable service snapshot before invoking module generation, then bind generated Applications to that exact reviewed revision.
• Preserve the remote direct-apply prohibition from Block remote direct apply: verify exact local k3d target or require GitOps #151.
• Add an end-to-end Mind-shaped test covering local k3d Argo reconciliation and AWS render/plan/publish with no Kubernetes direct apply.

Plugin dependencies:

• Implement the promotable GitOps Kubernetes output profile service-go-grpc#42
• Implement the promotable GitOps Kubernetes output profile service-nextjs#31
• Implement the promotable GitOps Kubernetes output profile service-postgres#16
• Implement the promotable GitOps Kubernetes output profile service-redis#5
• Implement the promotable GitOps Kubernetes output profile service-s3#6
• Implement the promotable GitOps Kubernetes output profile service-vault#7

Blocks codefly-dev/mind#216.