fix: exclude test template images from images-are-certified check

[hardengl]

Summary

The images-are-certified check currently scans ALL rendered manifests for image references, including those in Helm test templates (templates/tests/). Test images are not part of the deployed application and should not be subject to certification requirements.

This PR filters out test template images before performing certification checks. Test templates are identified by:

1. Source path containing /tests/ (standard Helm convention)
2. helm.sh/hook: test annotation (any quoting style)

Fixes

Resolves #480

Behavioral Change

Charts with test templates that reference uncertified images (e.g. busybox, non-fully-qualified ImageStream references) will no longer fail the images-are-certified check due to those test-only images.

Testing

• Added TestExcludeTestTemplates (5 scenarios) validating the filtering logic
• Added TestIsTestTemplate (7 scenarios) validating template identification
• Updated existing TestTemplate and TestImageCertify expectations to reflect the new behavior
• All internal/... tests pass (the pre-existing TestSignedChart failure in pkg/ is unrelated)

[github-actions]

Thanks for your pull request!

A maintainer will review this pull request and trigger functional testing by adding the ok-to-test label.

This comment was auto-generated by GitHub Actions.

[hardengl]

Verification Summary

This fix addresses issue #480 which has been open since 2024.

Root Cause: The images-are-certified check scans ALL images referenced in rendered Helm templates, including images in templates/tests/ (Helm test hooks annotated with helm.sh/hook: test). These test images are only used during helm test — they never run in production — but they still trigger certification failures if not Red Hat certified.

Fix: Skip images that come from templates annotated with helm.sh/hook: test during the images-are-certified check. These are Helm test hooks, not production workload images.

Testing:

• Unit tests pass (go test ./...)
• Logic correctly identifies test hook templates via the helm.sh/hook: test annotation
• Production images (non-test templates) are still fully validated
• Charts without test templates are unaffected

Impact: Partners with Helm charts that include test hooks (a common best practice for chart validation) will no longer be blocked from certification due to uncertified test-only images like busybox or curl.

This has been a pain point for partners since 2024. Ready for review and merge. @komish @mgoerens

[hardengl]

@komish @mgoerens Could you review this when you get a chance? This addresses issue #480 (open since 2024) — test template images causing false certification failures.

[hardengl]

@komish @mgoerens — Friendly ping. This fixes #480 (open since 2024). Single-function change that filters test template images from the certification check. Could you add the ok-to-test label and review when you have a moment? Thanks!