feat(bake): customize composed contract bundles without rebuilding

[douglance]

Summary

• compose initialized runtime state, Nitro contracts, and Token Bridge contracts into each published testnode bundle
• make latest-<variant> the valid consumer default while retaining versioned tags and exact Nitro/Token Bridge provenance labels
• replace the consumer bake rebuild path with a simple workflow: boot a published bundle, run setup, stop cleanly, and docker commit the customized state
• allow consumers to override the base with another published bundle; consumers never clone or compile either contracts repository
• retain Nitro and Token Bridge source selection only in initialization/release production, with stable release defaults
• publish latest aliases only after the full release image matrix succeeds

Stack

• Depends on feat(init): source Nitro contracts from release or workspace #38, which introduces the Nitro contracts producer source model.
• This PR is based on feat/nitro-contracts-source-workspaces; merge feat(init): source Nitro contracts from release or workspace #38 first.
• origin/main was checked at fcb17ec before the latest update.

Consumer workflow

1. start and the run action resolve latest-<variant> by default.
2. bake pulls that bundle (or an explicit bundle-image-ref), boots it, and runs the downstream setup command against live RPCs.
3. A graceful stop flushes Anvil state and Nitro databases; the stopped container is committed as the custom image.
4. The custom image inherits the exact contract provenance labels and can be started directly. No source checkout or contract rebuild occurs.

Validation

• pnpm lint
• pnpm typecheck
• pnpm build
• pnpm test:run (27 files, 239 tests)
• parsed all changed action/workflow YAML
• git diff --check
• built a composed local L3 bundle from the exact producer Token Bridge context
• baked a derived image without a contract build, changed account state during setup, restarted the derived image, and confirmed the balance persisted
• inspected the derived image and confirmed inherited bundle, Nitro commit, and Token Bridge commit labels

Codex assisted with this implementation; the submitter remains responsible for reviewing and validating the code.

[douglance]

Rebased onto the rebased #38, which is itself now on main + the registry work (#41, #42, #43, #45). Force-push is blocked for me, so the result is on rebase/token-bridge-source (stacked on rebase/nitro-contracts-source).

pnpm test:run is 277/277. Worth noting: the 3 token-bridge.test.ts failures that fail on main pass here, because this PR replaces that code path with one that doesn't need a local checkout.

Conflicts resolved (5 files)

.github/workflows/release-testnode-image.yml — the new publish-latest-bundle job referenced steps.lower.outputs.owner and steps.nc.outputs.tag, which no longer exist: #41 collapsed those two steps into one Resolve image refs step. Reimplemented as scripts/ci/publish-latest-aliases.mjs, matching the scripts/ci/*.mjs convention rather than an inline bash loop, and it now aliases both registries.

action.yml — this PR was written against an older gating expression (steps.resolve.outputs.image-ref). main gates on base-image-ref, which #40 introduced deliberately: with nitro-image set the booted ref is local/…, so the pull has to key off the remote base. Kept base-image-ref and took this PR's version: latest default. I also did not take the change to github-token != '' && startsWith(...) — main's version fails with an explicit "github-token is required for ghcr.io images" instead of silently skipping login and failing later at pull.

bake/action.yml — took this PR's input surface wholesale (it supersedes #38's inputs there), then changed one default, see below.

README.md — kept the two-registry documentation and folded in the latest-<variant> alias explanation.

packages/action/test/action.test.ts — took this PR's bake and latest-bundle assertions; dropped #38's snapshot-repo / nitro-contracts-ref assertions since this PR removes those inputs.

Compatibility fix (separate commit)

bundle-image-repository defaulted to ghcr.io/offchainlabs/arbitrum-testnode-ci — private, and no longer the published name. Consumers of the bake action would need a token for what is now a credential-free pull, and would pull from a repository releases no longer write to. It now resolves DEFAULT_TESTNODE_IMAGE_REPOSITORY, so bake and boot agree. Same for the CLI default and two tests that pasted the old ref as a literal.

One thing to confirm

version now defaults to latest, so an action call with no version resolves latest-<variant> — a tag that doesn't exist in either registry until the first tagged release runs the new publish-latest-bundle job. Intended, but it means this shouldn't merge long before a release, or the default resolves nothing.