plane(1.4): up.sh by profile -- context, registry, pool and images file from kind.toml

ops/ax/up.sh reads kube_context, registry, pools.default and the images path
with `python -m openultrasast.plane.profile --print`, writes the runner digest to
ops/k8s/profiles/kind-images.json instead of ~/.cache/.../runner-image, renders
ops/ax/workerpool.yaml.tmpl from the profile's pool (POOL_NAME/REPLICAS/CPU/
MEMORY, WORKER_IMAGE), and keeps an existing pool and an ax CLI newer than its
checkout instead of rebuilding them (ko and go install would refill several GB
of Go cache on this disk). smoke-run.sh takes the runner from `--print
images.runner` and runs the checkout's code with OUSAST_PYTHON. repin_templates
reads the JSON images file (runner key; the one-line pin still reads). `--print
images` returns the file path (the first live rerun fell over this). Templates
and the generated validation-46 Tasks re-pinned to the rebuilt image (128
lines, one digest).

Live: up.sh reran idempotently on kind in 38 s (every step kept except the
runner build); smoke-run.sh done in 24 s on the new image, facts.json 451 B,
summary.json 238 B delivered (record: benchmarks/measurements/2026-10-02-k8s-01-profile/).

Gates: pytest 2010 passed, 42 skipped, exit 0; ruff check 0; ruff format 0;
mypy 0; mkdocs build --strict 0.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

src/openultrasast/plane/generate.py

@@ -45,8 +45,9 @@ The recorded triage cost is derived per file: a batched-check record's ``usd`` p
 hunts, and its ``usage`` counts only the hunts (``verify_sinks._Recording`` slices the client's usage from the
 first hunt on), so the triage share is ``usd`` minus that usage priced at the reference model's list price.
 
-``--runner-image FILE`` (``~/.cache/ousast/ax-src/runner-image``, written by ``ops/ax/up.sh``) re-pins the
-templates' ``image:`` to the digest in that file before generating, so a rebuilt image is one command.
+``--runner-image FILE`` (the profile's images file, ``ops/k8s/profiles/kind-images.json``, written by ``ops/ax/up.sh``;
+the older one-line pin file still reads) re-pins the templates' ``image:`` to the runner digest in that file before
+generating, so a rebuilt image is one command.
 """
 
 from __future__ import annotations
@@ -485,11 +486,18 @@ _IMAGE_LINE = re.compile(r'^(\s*image:\s*)"?[^"\s]+"?\s*$', re.MULTILINE)
 
 
 def repin_templates(plane: Path, image_file: Path) -> str:
-    """Set every template's ``image:`` to the digest-pinned reference in ``image_file`` (as ``ops/ax/up.sh``
-    writes it); comments and layout are kept. Returns the reference."""
-    image = image_file.read_text(encoding="utf-8").strip()
-    if not re.fullmatch(r"\S+@sha256:[0-9a-f]{64}", image):
-        raise ValueError(f"{image_file}: expected a digest-pinned image reference, got {image!r}")
+    """Set every template's ``image:`` to the runner reference of ``image_file``: a profile images file
+    (``{"runner": "<registry>/<name>@sha256:..."}``, as ``ops/ax/up.sh`` writes it) or the older one-line pin; a
+    reference without a digest is refused. Comments and layout are kept. Returns the reference. (Task 4.3 gives
+    the engine template ``images["engine"]``; until then only the runner key is read.)"""
+    from .profile import ProfileError, load_images
+
+    try:
+        image = load_images(image_file)["runner"]
+    except ProfileError as exc:
+        raise ValueError(str(exc)) from None
+    except KeyError:
+        raise ValueError(f"{image_file}: no runner image in the images file") from None
     for name in TEMPLATES:
         path = plane / "tasks" / f"{name}.yaml"
         text = path.read_text(encoding="utf-8")

src/openultrasast/plane/profile.py

@@ -229,7 +229,7 @@ def load_profile(name: str | None = None, environ: Mapping[str, str] | None = No
 
 def _lookup(profile: PlaneProfile, dotted: str) -> str:
     head, _, rest = dotted.partition(".")
-    if head == "images":
+    if head == "images" and rest:
         images = profile.load_images()
         if rest not in images:
             raise ProfileError(f"{profile.images}: no image named {rest!r} (have {', '.join(sorted(images))})")