Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ci/pipelines/publisher.yml`:
- Line 19: The image reference `light-stemcell-builder-registry-image` on line
19 does not match the actual resource name that has been renamed to
`aws-light-stemcell-builder-registry-image` (as defined at line 751 and fetched
by the job at line 130). Update the image field on line 19 from
`light-stemcell-builder-registry-image` to
`aws-light-stemcell-builder-registry-image` to resolve the artifact name
mismatch so the build-<prefix>-stemcell task can locate the correct image at
runtime.

In `@ci/tasks/light-google/create-public-image.sh`:
- Around line 65-67: The `touch image` command on line 65 only updates the
modification time without clearing existing file contents, which means if the
image file already exists from a previous extraction, it will retain the full
heavy payload when calculating the SHA1 hash and packaging into the tar archive.
Replace `touch image` with a command that actually empties the file contents,
such as using output redirection (> image) or truncate, to ensure image is
created as an empty light placeholder before the SHA1 calculation on line 66.
- Around line 53-54: The guest_os_features_flag variable is being passed as a
quoted argument to gcloud compute images create even when it is empty, which
causes gcloud argument parsing to fail for configurations with no features
enabled. Remove the quotes around the guest_os_features_flag variable and
conditionally include the flag only when it contains a non-empty value, such as
by using parameter expansion (e.g., only adding the flag and its value when the
variable is not empty).

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ci/tasks/light-aws/cleanup-ami.sh`:
- Around line 14-16: The parameter expansion guards for AWS credentials in the
export statements for AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and
AWS_DEFAULT_REGION are using the `?` operator which only checks if variables are
set, but allows empty values. Change each guard from the current
`${variable?'must be set'}` format to `${variable:?'must be set'}` format by
adding a colon before the question mark. This will ensure that the script fails
immediately if any of these credential variables are empty or unset, rather than
passing validation and failing later during AWS API calls.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ci/pipelines/publisher.yml`:
- Around line 125-128: The in_parallel block contains an empty do: branch on
line 126 that has no nested steps, while the two build_light_aws_stemcell_new
calls on the following lines are sibling list items under in_parallel rather
than children of the do branch. Remove the empty do: line entirely so that the
two build_light_aws_stemcell_new function calls remain as direct children of
in_parallel with proper indentation.