Patched first-party images run go build only, so tests carried in a patch never run #4318

Fifteen Dockerfiles under packages/ today apply patches to an upstream source tree and then run go build, packages/system/opensearch-operator/images/opensearch-operator/Dockerfile among them. Nothing in the repository runs go test on the patched tree: a _test.go carried inside a patch does not break go build, and no CI job compiles or runs it.

#4317 carries the upstream tests for the operator's restart gate inside restart-on-permanently-yellow.diff. They were green when the patch was cut, by hand, in a scratch tree. After the next ARG VERSION bump nothing notices if they stop compiling or start failing. The same holds for every other patched image; the older bootstrap-voting-exclusion.diff carries no tests at all, so there the gap is one step earlier.

Two places this could live: a RUN go test on the packages the patches touch, in the builder stage before the final build, or a unit-lane check that applies the patches to the pinned tarball and runs the tests there. Which one, and whether the build-time cost is acceptable for all fifteen images, is a maintainer call, so I am filing this rather than opening a PR.