fix(controller)!: use the latest available creation time for NewestBuild

[krancour]

An image's creation time was taken from an org.opencontainers.image.created or org.label-schema.build-date label in preference to the creation time recorded in its config. Labels are copied from the base image unless a build overwrites them, so an image that sets no label of its own reports the build time of the image it was built from.

ubuntu:26.04 -- and therefore ubuntu:latest -- carries such a label; ubuntu:24.04 did not. Every image built from one of these between two republishes of the base reports an identical creation time. NewestBuild then sorts on a tie, falls back to reverse-lexical tag order, and truncates to discoveryLimit, so new images can go undiscovered rather than merely mis-ranked.

Separately, annotations on an index, and on an index's references to the images it contains, were read for display but never for creation time. Multi-arch builds annotated with buildx --annotation index:... got no benefit from them.

Creation time is now taken from the outermost metadata that claims one -- an index's annotations, then an index's reference to an image, then the image's own manifest -- and, failing all of those, from the later of the config's creation time and any claim in its labels. No object in a registry can be older than anything referencing it, and every way one of these timestamps goes wrong understates it: a label copied from a base image, a timestamp carried over with a reused layer, a fixed timestamp chosen to make digests reproducible. Taking the outermost claim, and otherwise the later of the two remaining, amounts to using the latest date available.

Verified against a local registry with images built to exhibit each shape: base image label inheritance, index-only annotations, a reproducible build with a fixed config timestamp, and all four metadata locations populated at once.

Note for upgrades: images that were previously mis-ranked, or truncated away by discoveryLimit, may become visible. On a Warehouse with auto-promotion enabled, that can trigger promotions for images that already existed. This is why this fix will not be back ported to v1.11.x and will, instead, ship with v1.12.0.

Refs: #4635, #4636, #5179

cc @34fathombelow

[netlify]

✅ Deploy Preview for docs-kargo-io ready!

Name	Link
🔨 Latest commit	5f69cad
🔍 Latest deploy log	https://app.netlify.com/projects/docs-kargo-io/deploys/6a76307e5285340008646910
😎 Deploy Preview	https://deploy-preview-6777.docs.kargo.io
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 30.84%. Comparing base (2f0ad08) to head (5f69cad).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6777   +/-   ##
=======================================
  Coverage   30.83%   30.84%           
=======================================
  Files         824      824           
  Lines       80467    80475    +8     
=======================================
+ Hits        24815    24823    +8     
  Misses      54196    54196           
  Partials     1456     1456           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[fuskovic]

lgtm