fix(ci): point the devnet deploy at the app-chart values files

[majidkhan07]

Summary

Points the devnet deploy at the app-chart values files. canton-indexer, canton-middleware and
canton-middleware-api are all managed by ArgoCD now, so the legacy
definitions/canton/validator-dev1/*.yml blocks this wrote to are enabled: false and render
nothing.

Nothing has been lost yet — no deploy has run since they migrated — but the next one would have
been a silent no-op for all three.

The table needs three fields

None is derivable from the others:

canton-middleware-api|canton-middleware-api|ghcr.io/chainsafe/canton-erc20-api
canton-indexer|canton-indexer|ghcr.io/chainsafe/canton-indexer
canton-middleware|canton-bridge-relayer|ghcr.io/chainsafe/canton-middleware

canton-middleware's Deployment is canton-bridge-relayer, and canton-middleware-api's image is
canton-erc20-api. A folder-name-only table would write nothing for those two.

The image is one string in this layout, not repository + tag, so the yq expression changes as
well as the path.

The gate script

detect-config-changes.sh reads the deployed tag from each values file and requires all three to
agree. It now extracts the tag from the image string, and only trusts it when the repository is the
one expected and a tag is actually present. That second condition matters: ${image%:*}
returns the whole string when there is no colon, so an untagged image would otherwise be read as a
tag.

The added assert

Each yq write is checked to have touched exactly one line. These three values files embed a
config file verbatim inside an ExternalSecret, complete with external-secrets {{ }} placeholders.
A yq reformat there changes the rendered Secret and would pass the infra repo's CI unnoticed —
yamllint skips clusters/**/values.yaml and kubeconform skips values.yaml.

Tested

With yq v4.53.6 and the real repos:

• write and read expressions work against all three values files; a wrong key returns null
• yq round-trips all three files touching only the image line
• tag extraction covers untagged, empty, trailing colon, wrong repository, prefix collision and
  literal null
• the gate script runs end to end and reads all three tags: config_changed=false
• gate holds correctly when one service is on a different tag, and when an image is pointed at
  another repository — with accurate reason text in the PR comment
• the assert passes on a clean write, fires on a stray change, fails safe on a missing file
• workflow YAML parses; script passes bash -n

Not tested locally: secrets, the GraphQL signed commit, gh pr create, --auto merge, and the API
read-back, which needs the branch to exist. Worth watching the first run.

One suggestion, deliberately not in this PR

The table now lives in two files with a "keep in sync" comment. Today's incident was a
two-places-must-agree failure. A single shared file both read would remove the class — happy to
follow up if you'd like it.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@9fb5f48). Learn more about missing BASE report.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #378   +/-   ##
=======================================
  Coverage        ?   33.86%           
=======================================
  Files           ?      163           
  Lines           ?    12610           
  Branches        ?        0           
=======================================
  Hits            ?     4271           
  Misses          ?     7999           
  Partials        ?      340           

Flag	Coverage Δ
unittests	33.86% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.