fix: root-cause Flux Setters silent no-op - namespace mismatch

ImageUpdateAutomation only lists ImagePolicy objects in its own
namespace (image-automation-controller's getPolicies() scopes the
List() to obj.Namespace, confirmed by reading v1.2.4 source) - the
$imagepolicy marker's namespace:name is only used to match against
that pre-filtered list, not to broaden the search. Our
ImageUpdateAutomation lived in flux-system while its ImagePolicy
lived in hello-app, so the policy was invisible and Setters always
found zero markers to update ("repository up-to-date" forever),
regardless of correct marker syntax/RBAC/policy resolution.

Moved ImageUpdateAutomation into the hello-app namespace (alongside
its ImagePolicy), keeping a cross-namespace sourceRef back to the
flux-system GitRepository. Also fixed the commit messageTemplate,
which used the removed .Updated field (v1.2.4 requires .Changed).

Verified live: Flux pushed commit 0273f15 updating deployment.yaml's
tag on its own, and the cluster rolled out that image without any CI
involvement. Removed the update-deployment-tag CI workaround job
accordingly - it's redundant now and would otherwise race with
Flux's own commits.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GJNvvV3RrvX6TRZGAKEUeY

.forgejo/workflows/build-hello-app.yml

@@ -15,8 +15,6 @@ jobs:
     container:
       image: gcr.io/kaniko-project/executor:debug
       options: --entrypoint ""
-    outputs:
-      tag: ${{ steps.build.outputs.tag }}
     steps:
       # actions/checkout@v4 needs a Node.js runtime, which this minimal
       # kaniko image doesn't have (no package manager to add it either) -
@@ -45,40 +43,10 @@ jobs:
           sed -i "s/__GIT_SHA__/$SHORT_SHA/; s/__BUILD_TIME__/$BUILD_TIME/" apps/hello-app/src/index.html
 
       - name: Build and push
-        id: build
         run: |
           TAG="main-${GITHUB_SHA::7}-$(date +%s)"
-          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           /kaniko/executor \
             --context="${{ github.workspace }}/apps/hello-app/src" \
             --dockerfile="${{ github.workspace }}/apps/hello-app/src/Dockerfile" \
             --destination="git.boglabob.com/${{ vars.FORGEJO_ORG }}/hello-app:$TAG" \
             --destination="git.boglabob.com/${{ vars.FORGEJO_ORG }}/hello-app:latest"
-
-  # Flux's ImageUpdateAutomation (image-automation.yaml) should be doing this
-  # commit-back step instead - its $imagepolicy Setters marker in
-  # deployment.yaml is correctly formatted and verified against Flux's own
-  # docs, ImagePolicy correctly resolves each new tag, and every other part
-  # of the chain works, but it never actually commits (always reports
-  # "repository up-to-date" with nothing to change) for reasons that
-  # resisted a lengthy investigation - even a from-scratch Flux bootstrap
-  # against a fresh controller instance didn't change the behavior.
-  # ImageRepository/ImagePolicy are kept for visibility into what tag is
-  # available; this job does the actual commit as a working substitute.
-  update-deployment-tag:
-    needs: build-and-push
-    runs-on: docker
-    container:
-      image: alpine/git
-    steps:
-      - name: Commit new image tag to deployment.yaml
-        run: |
-          git config --global user.email "flux@boglabob.com"
-          git config --global user.name "fluxcdbot"
-          git clone "https://${{ vars.FORGEJO_USER }}:${{ secrets.FORGEJO_TOKEN }}@git.boglabob.com/${{ github.repository }}.git" repo
-          cd repo
-          TAG="${{ needs.build-and-push.outputs.tag }}"
-          sed -i "s|\(image: git.boglabob.com/${{ vars.FORGEJO_ORG }}/hello-app:\)[^ ]*|\1$TAG|" apps/hello-app/deployment.yaml
-          git add apps/hello-app/deployment.yaml
-          git diff --cached --quiet || git commit -m "chore(hello-app): auto-update image to $TAG"
-          git push