feat(ci-tools): ship diffutils (diff + cmp); finalize v4.1.0

Andrew Dunnrequested to merge
wt/ci-tools-diffutils into main

What

Add diffutils (diff + cmp) to the ci-tools image, and finalize the pending release as v4.1.0.

Why diffutils

ubi9-minimal ships neither diff nor cmp. A consumer's shell no-op/idempotency check built on them fails command-not-found and, under a 2>/dev/null redirect, degrades silently to the "changed" path. This hid a real downstream bug: a vendor-package generator's daily submit re-ran and re-posted a Slack notification every night because its manifest no-op compare (cmp -s, then diff -q) never actually ran. The Containerfile carries a keep-this note so it is not dropped.

Why v4.1.0 (not the pencilled 4.0.3)

main has drifted past the pencilled 4.0.3 patch: it carries two new public templates since v4.0.2 -- automerge-gate and osv-verdict -- which make this semantically a minor release, plus the reflow fix and dependency bumps. The CHANGELOG is completed to document all of it; the [4.0.3] entry is promoted to [4.1.0] and its pin reference updated.

Release + rollout (after merge)

  1. Merge -> main pipeline rebuilds ci-tools:latest with diffutils (validates the package installs).
  2. Tag v4.1.0 (annotated) -> builds ci-tools:v4.1.0 + publishes the release.
  3. Re-pin consumers @v4.0.2 -> @v4.1.0 (p1-vp-generator-automation, p1-vp-generator).

Verification

  • ci-tools image contents confirmed by skopeo-extracting v4.0.2: no diff, no cmp binary present -- the gap this fills.
  • diffutils is the standard UBI9 baseos package providing both /usr/bin/diff and /usr/bin/cmp.

Merge request reports