capi-providers-cpprovider: every build pushes over the kamaji provider's release tag, and a second tag ends in a bare dash #4503

Every build of the kamaji control-plane provider image pushes under its release tag, PR builds included. packages/system/capi-providers-cpprovider/Makefile sets IMAGE_TAG = $(UPSTREAM_VERSION)-cozystack.$(COZYSTACK_REV) in the file. In make a variable set in the file beats one from the environment, and CI passes IMAGE_TAG through the environment (IMAGE_TAG: pr-<N>-<sha> in pull-requests.yaml).

I checked it with make -n image. It prints --tag .../cluster-api-control-plane-provider-kamaji:v0.19.0-cozystack.0 with and without IMAGE_TAG=pr-1-abc in the environment. So each same-repo PR build that touches this package overwrites v0.19.0-cozystack.0 in the CI registry with its own image.

The same target adds a second tag, $(IMAGE_BASE):$(IMAGE_TAG)-$(TAG). TAG is not defined anywhere, so on every build it comes out as v0.19.0-cozystack.0- with a trailing dash.

The refs are fine: the Makefile stamps the digest, so what gets deployed is pinned. What is wrong is the release tag that moves and the junk tag. The fix is to let IMAGE_TAG from CI win (?=, or a separate variable for the component version), and to drop or define the second tag.