Revert "Bump DAP workflow image path to v0.0.22"

What does this MR do and why?

Reverts !261168 (merged) by pointing IMAGE_PATH in Ai::DuoWorkflows::StartWorkflowService back from workflow-generic-image:v0.0.22 to v0.0.21.

This MR is for INC-15070. v0.0.22 preinstalls Duo CLI 9.29.0 (gitlab-org/duo-workflow/default-docker-image!55 (merged)). v0.0.21 has 9.27.0.

Jobs that use the default image skip the CLI download. Reverting DUO_CLI_VERSION alone (!261473 (merged)) therefore does not fix them, and this MR is needed as well.

Root cause

In Duo CLI 9.29.0, gitlab-org/editor-extensions/gitlab-lsp@e75d2c37 extracts the embedded rg to ~/.cache and no longer falls back to the temp directory. The CI sandbox mounts $HOME read-only, so rg is unavailable and find_files fails:

[RgBinaryProvider] Failed to extract rg from /$bunfs/root/rg-wk7861fv.: Error: EROFS: read-only file system, mkdir '/root/.cache'
[RipgrepService] rg is unavailable: Error: Could not extract the embedded rg to a private directory; set GITLAB_BIN_DIR to a directory only you can write

Example default-image job, which logs duo-cli already present: https://gitlab.com/gitlab-org/cells/http-router/-/jobs/17106392847

Do not move forward to v0.0.23 (CLI 9.30.0): the 9.30.0 release does not change the rg extraction code.

How to verify

Start a flow from a mention on a project that uses the default image. The job uses workflow-generic-image:v0.0.21, duo --version prints 9.27.0, and the log contains no rg is unavailable lines.

🤖 Generated with Claude Code