[adrianmxb]

A runtime node can retain an older druid-dev:stable image even after the registry tag is updated. The SPA's startup watcher arguments then fail with unknown flag: --watch-path, leaving WebDAV unavailable and producing nginx 502 responses that browsers report as CORS errors.

Refresh registry-tagged container images at startup in both runtime backends:

• Kubernetes Jobs, persistent main/init containers, and helper Jobs use imagePullPolicy: Always.
• Docker checks the registry through ImagePull even when a tagged image is cached, and propagates HTTP and streamed pull failures instead of proceeding with stale content.
• Digest-pinned and explicit :local development images retain cache reuse. Integration fixtures use explicit local tags.

The SPA can continue using druid-dev:stable. Replaces https://github.com/highcard-dev/monorepo/pull/384.

Validation: go test ./..., go vet ./internal/runtime/..., git diff --check, and compilation of both integration suites with go test -run '^$' -tags='integration docker' / -tags='integration kubernetes'. Regression tests cover cached stable/version tags, digest/local caching, missing images, pull failures, and policies in generated workload specs.

Rollout: deploy the CLI through its existing release pipeline, then recreate affected Druid UI workloads through Developer tools so they receive the new pod policy. Tag updates apply at container startup; running containers are not automatically restarted. No direct production changes are included.

[druid-infra]

Error: This repo is not allowlisted for Atlantis.