fix: resolve manifest list digest instead of platform-specific digest

  The get_image_sha() function was using .manifests[0].digest which
  returns the first platform entry (amd64) instead of the manifest list
  digest. This causes the operator CSV to pin task images (buildah, s2i,
  skopeo, ubi-minimal) to amd64-only digests, breaking ARM64 and
  multi-arch clusters with exec format error.

  Fix by computing sha256 of the raw manifest list content, which
  produces the manifest list digest that container runtimes use to
  resolve the correct platform at pull time.

Signed-off-by: ab-ghosh <abghosh@redhat.com>

Author: ab-ghosh

hack/openshift/update-image-sha.sh

@@ -26,10 +26,10 @@ find_latest_version() {
   echo "$version"
 }
 
-# Get SHA digest for an image:tag
-get_image_sha() {
+# Get manifest list digest for an image:tag (multi-arch)
+get_manifest_list_digest() {
   local image_url=$1
-  skopeo inspect --raw docker://${image_url} | jq -r '.manifests[0].digest // .digest'
+  skopeo inspect --no-tags docker://${image_url} | jq -r '.Digest'
 }
 
 # Update image SHA in YAML files
@@ -59,7 +59,7 @@ main() {
     echo "  Latest version: $latest_version"
 
     image_url="${image_registry}:${latest_version}"
-    image_sha=$(get_image_sha "$image_url")
+    image_sha=$(get_manifest_list_digest "$image_url")
     echo "  SHA: $image_sha"
 
     update_yaml_files "$image_registry" "$image_sha"