fix(seaweedfs): run the in-tree SeaweedFS image in every component

With the image keys unset the vendored chart renders chrislusf/seaweedfs
at its appVersion, so the patched build from images/seaweedfs would be
built and never run, and the S3 gateway would keep being OOM-killed on
large GETs. Point every component at the in-tree image, pinned by
digest like every first-party reference, and hold that in a unit test
so a values change cannot quietly fall back to the upstream binary.

Assisted-by: LLM
Signed-off-by: Alexey Artamonov <aleksei.artamonov@aenix.io>

packages/system/seaweedfs/tests/image_test.yaml

@@ -0,0 +1,39 @@
+suite: seaweedfs image
+
+# Every SeaweedFS component must run the in-tree build from images/seaweedfs,
+# which carries the patches in images/seaweedfs/patches. The vendored chart
+# falls back to chrislusf/seaweedfs at its appVersion when the image keys are
+# unset, and that is the unpatched upstream binary. The reference must carry a
+# digest, as every first-party reference does (docs/agents/image-refs.md).
+
+templates:
+  - charts/seaweedfs/templates/master/master-statefulset.yaml
+  - charts/seaweedfs/templates/volume/volume-statefulset.yaml
+  - charts/seaweedfs/templates/filer/filer-statefulset.yaml
+  - charts/seaweedfs/templates/s3/s3-deployment.yaml
+  # filer-statefulset includes it for its checksum annotation.
+  - charts/seaweedfs/templates/s3/s3-secret.yaml
+
+release:
+  name: seaweedfs
+  namespace: cozy-seaweedfs
+
+tests:
+  - it: runs the in-tree image in the master
+    template: charts/seaweedfs/templates/master/master-statefulset.yaml
+    asserts: &inTreeImage
+      - matchRegex:
+          path: spec.template.spec.containers[0].image
+          pattern: ^ghcr\.io/cozystack/cozystack/seaweedfs:[^@]+@sha256:[0-9a-f]{64}$
+
+  - it: runs the in-tree image in the volume servers
+    template: charts/seaweedfs/templates/volume/volume-statefulset.yaml
+    asserts: *inTreeImage
+
+  - it: runs the in-tree image in the filer
+    template: charts/seaweedfs/templates/filer/filer-statefulset.yaml
+    asserts: *inTreeImage
+
+  - it: runs the in-tree image in the S3 gateway
+    template: charts/seaweedfs/templates/s3/s3-deployment.yaml
+    asserts: *inTreeImage

packages/system/seaweedfs/values.yaml

@@ -25,6 +25,13 @@ seaweedfs:
   # chart directly from its ExternalArtifact without re-rendering extra/seaweedfs.
   # The guard also refuses to render at all if this pin is ever lifted.
   fullnameOverride: seaweedfs
+  # Built in-tree from images/seaweedfs, which carries the patches in
+  # images/seaweedfs/patches. Without this block the vendored chart falls back
+  # to chrislusf/seaweedfs at its appVersion, the unpatched upstream build.
+  # `make image` rewrites both keys on every build.
+  image:
+    repository: "ghcr.io/cozystack/cozystack/seaweedfs"
+    tag: "4.45@sha256:a1a0a27df03d67567852f19eed106a336b2acfe53b4ba9c36c18a26a8ee3043c"
   master:
     # At the shipped replicationFactor of 2 the size limit and
     # extraEnvironmentVars.WEED_MASTER_VOLUME_GROWTH_COPY_2 below are one