v8.4.1
`instance` `promote` job no longer rescans the pushed image from the
registry for its SBOM. `promote` already retags `:latest`/`:stable` via a
raw `skopeo copy` (never a rebuild), so the digest it just moved is
byte-identical to what `build` already scanned locally (from an OCI export,
before push) and uploaded as the `sbom.json` artifact `promote` receives via
`needs: [..., {job: build, optional: true}]`. The registry rescan was pure
duplicate work — and on roon-bootc's ~1.36GB image it repeatedly OOM-killed
`promote` on the unsized `crucible` runner lane (`promote` has no
`vm_size`-equivalent input), producing 14 consecutive red main pipelines
(2026-07-12 through 2026-07-26) even though the underlying `:latest`/`:stable`
promotions were succeeding on every attempt, including each pipeline's
GitLab-auto-retried ones — the retag always completed before `syft` OOM'd.
`immutable/crimson`, `immutable/instance`, and `immutable/carmine` share the
same code path with comparable-or-larger images and were latent-risk for the
same failure the next time their base image changes.
### Fixed
- `instance` `promote` job reuses `build`'s `sbom.json` artifact instead of
running a second `syft registry:...` scan against the freshly-promoted
`:latest` tag. Drops `.install_syft` from `promote` (keeps
`.install_skopeo`, still needed for the retag/digest-compare steps). No
interface change — non-breaking for all consumers.