Allow commit SHA image tags with the automation writer pool

[Alex R (alexr17)]

Summary

#105 added a v2.16.0 image floor for brainstore.automationwriter. It called semverCompare ">=2.16.0" on brainstore.image.tag every time. That only works with release tags. Once the pool is enabled (replicas > 0):

• A commit SHA tag (e.g. abc1234) fails the whole render with error calling semverCompare: invalid semantic version.
• An all-digit short SHA (e.g. 1234567) only passes because it is read as version 1234567.0.0.

This change keeps the floor but only applies it when the tag is a stable release tag (vX.Y.Z or X.Y.Z). It uses the same regex that _brainstore-startup-gate.tpl already uses to validate minimumVersion. SHAs and other custom tags carry no version, so the chart doesn't check them, and the operator is responsible for using an image that includes v2.16.0.

brainstore.image.tag	Before	After
v2.17.0, 2.16.0	renders	renders
v2.14.0, 2.15.3	rejected	rejected
full or short SHA	render error	renders
1234567	renders (parsed as 1234567.0.0)	renders (not checked)
v2.16.0-rc.1	rejected	renders (not checked)

Pre-release tags are now skipped instead of being treated as older than 2.16.0. This matches how the startup gate treats tags that aren't stable releases.

The check uses a nested if instead of and so semverCompare never runs on a tag that isn't a release tag.

Changes

• templates/_helpers.tpl: gate the semverCompare in braintrust.automationWriter.validate on the release-tag regex.
• Tests: full SHA, short SHA, the automation writer Deployment rendering with a SHA image, and 2.15.3 (no v prefix) still being rejected.
• Docs: values.yaml, README.md and AGENTS.md describe the release-tag-only check. Also removed the outdated line saying the chart's default image is older than v2.16.0; it's v2.17.0 now.
• AGENTS.md: new "Plan the Full Input Matrix First" section and review checklist item. Before a feature ships, list every supported input shape (image tag formats, clouds, enabled/disabled paths, --reuse-values upgrades, null/missing values) and add a test for each, so a gate like this one can't block a supported configuration again.

No Chart.yaml version bump, per AGENTS.md (bumps need coordination).

Testing

• The 3 new SHA tests failed before the fix and pass after.
• ./test.sh passes: Python unittests, all helm-unittest suites and helm lint.
• Manual helm template with each tag in the table above gave the "After" results.
• ./validate.sh was not run because it needs a live Kubernetes API server.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-08T23:13:43.287876Z	1ec8b4a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "Codex (@codex) review" or "Codex (@codex) security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.