kubevirt-cdi-operator resolves its CDI version at update time, so the deployed release moves without anyone choosing it #4190

packages/system/kubevirt-cdi-operator/Makefile picks its CDI version at the moment someone runs make update:

export VERSION=$$(basename $$(curl -s -w %{redirect_url} https://github.com/kubevirt/containerized-data-importer/releases/latest)) && \
wget https://github.com/kubevirt/containerized-data-importer/releases/download/$$VERSION/cdi-operator.yaml -O templates/cdi-operator.yaml

That package decides which CDI the platform runs, so the deployed version can move without anyone editing a version anywhere. The vendored manifest is the only record of what got picked, and a refresh done for an unrelated reason moves it.

packages/system/kubevirt-operator/Makefile shows the shape that closes this, for the same class of vendored release manifest: RELEASE = v1.9.0 names the version, MANIFEST_SHA256 pins the asset, and the recipe refuses to write anything when the digest does not match. Moving to a new release is then an edit to those two lines rather than a side effect of running a target.

What makes this worth fixing rather than noting is that the version is becoming load-bearing for behaviour, not just for images. A readiness gate that classifies DataVolume phases has to enumerate the in-flight ones, and that list is correct against one CDI version. If a later CDI renames an in-flight phase, the renamed value falls out of the list, the catch-all leg reads it as healthy, and the gate degrades to not gating. Fail-open is the deliberate choice there, so nothing breaks loudly; the gate just stops doing its job for that phase, and the only thing that changed is a version nobody chose.

The same argument covers the images: seven quay.io/kubevirt/cdi-* references in the vendored manifest all carry whatever tag the last refresh resolved.

Filed separately from the readiness work because the gap predates it. #4107 adds RELEASE to the sibling kubevirt-cdi package for its own reason, which leaves this one as the remaining unpinned half of the pair.