skaffold-build: build via deployments build_it.yml, push descriptor to deployments

[johnworth]

Summary

Rewrites the reusable skaffold-build.yml workflow to fit the new deployments repo layout (its unification branch). Instead of building the image in-workflow and pushing a descriptor plus skaffold/k8s copies into cyverse-de/de-releases, the workflow now:

• checks out the service source repo and cyverse-de/deployments@main as siblings,
• runs the deployments build_it.yml playbook for the service, which builds + pushes the image and rewrites the canonical descriptor at ansible/roles/services/<svc>/files/<svc>.json,
• commits that descriptor and pushes it directly to the deployments main branch.

The build itself runs through the deployments repo's custom buildx builder, preserving the <image>:cache mode=max registry layer cache (so Clojure/Maven dependency downloads are reused instead of re-fetched from upstream).

Changes

• New inputs: service-name, deployments-repo, deployments-branch.
• Verifies the service role exists in the deployments checkout before running, so an unknown --tags can't silently build nothing.
• Drops the GitHub release, the de-releases checkout, and the jq/yq/kube-tools installs; adds skaffold + ansible installs.
• build-prerelease is kept but deprecated/ignored (no GitHub release is created anymore), so existing callers don't break.
• docker-build.yml and go-build.yml are intentionally unchanged.

Merge ordering

⚠️ The deployments unification branch (custom builder + descriptor paths) must merge to deployments main before this merges to main — otherwise the playbook, custom builder, and files/<svc>.json targets won't exist on deployments main.

Notes

• releases-repo-push-token must have push access to deployments main.
• Validated locally: skaffold's custom builder + --file-output produces the exact canonical descriptor format; all deployments skaffold configs parse; the workflow passes actionlint.

🤖 Generated with Claude Code