fix: keep image sync going when an upstream service disappears

[STRRL]

Problem

The weekly image sync has been failing since 2026-08-17 with ERROR: service 'kong' not found in upstream compose file.

Upstream removed the kong service from the default compose file in supabase/supabase#48153, where Envoy became the default API gateway. Kong lives on there as an opt in override in docker-compose.kong.yml.

kong was the first entry in MAPPINGS, and the loop exited on the first missing service, so the whole sync aborted before looking at any other component. One upstream rename was enough to stop everything.

Solution

Take kong out of the sync list and pin DefaultKongImage by hand, the same way DefaultPostgresImage is already pinned. Make the loop collect missing services and report all of them at the end instead of dying on the first one, while still exiting non zero so a scheduled run stays loud.

Major Changes

• hack/sync-upstream-images.sh
  • kong removed from MAPPINGS, with a note on why
  • a missing service now logs a warning and is skipped, instead of aborting the run. Every service that is still present gets synced
  • all missing services are reported together at the end, and the script exits 1 so the scheduled run still fails visibly
• api/v1alpha1/wellknown_images.go
  • DefaultKongImage moved out of the synced block into the manually pinned section, value unchanged at kong/kong:3.9.1
• image defaults
  • studio synced to 2026.08.03-sha-022b374. The other five components were already current

Verification

• script run on the branch: five components report up to date, studio updates, exit 0
• second run is idempotent, everything up to date, exit 0
• missing service path exercised on a scratch copy: remaining components still sync, all missing names reported, exit 1
• checked under both bash 3.2 and bash 5.3, no set -u problems with the empty array
• make manifests produces exactly one CRD change (studio default) and is idempotent
• make test green

Note

At the CI level this does not yet let a partial sync through: the sync step exits non zero, so make test and the PR creation step are skipped. A future upstream removal will still produce a red run with no PR. That is the intended tradeoff for now, favouring a loud failure over a silent partial sync.