fix(ci): pull pinned MinIO images from Quay

[salman1993]

Summary

CI is failing in main before tests start because Docker Hub denies pulls for minio/minio and minio/mc. Retrying the failed jobs produced the same errors.

Use MinIO’s Quay images in the development, harness, deployment Compose, and Helm configurations. Pin each image to its multi-platform digest and retain the release tags already used by deployment templates. Update the architecture reference to match.

Related issue

No duplicate issue or PR found. Addresses the image-pull failures in main CI attempt 2.

Testing

• Pulled both pinned images for Linux ARM64 and AMD64.
• Started an isolated Compose stack derived from the updated MinIO service definitions, once per architecture (AMD64 under local emulation).
• Verified the existing health check passed and the bucket initializer exited with code 0.
• Uploaded an object with mc cp, read it with mc cat, compared its content, and deleted it with mc rm on both architectures.
• Confirmed the initialized bucket was private and removed the temporary stack and volume.

Generated with Codex

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 78618804ec86a014524ad7d1fb55928e8f5c3edf...b89c146b1f6f2edfc1d59074392108dfe0006c59.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review b89c146b1f6f2edfc1d59074392108dfe0006c59 to authorize a new review.
Any previous review applies only to its recorded range.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-12T01:10:56.163463Z	b89c146	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

No actionable findings for head b89c146b1f6f2edfc1d59074392108dfe0006c59 against base 78618804ec86a014524ad7d1fb55928e8f5c3edf. This is a clear source/metadata review, not an approval.

• Contract: restore MinIO pulls while preserving storage, credentials, bucket privacy and startup ordering. Reviewed development Compose, harness Compose, deployment Compose, and all three Helm image consumers. They consistently use the new references without modifying those contracts; bundled Helm MinIO remains opt-in and external S3 is unaffected.
• Image compatibility: both Quay release tags return manifest-list bytes whose SHA-256 matches the pinned digest, with Linux AMD64 and ARM64 entries. Independent review checked release/config identity and existing init/healthcheck command support; I verified the manifest hashes/platforms and exact-release Dockerfiles. Full image references pass through the Helm templates unchanged.
• Validation: exact-head Helm lint/unit/render CI passed, and integration CI passed root-Compose startup and MinIO health checks. The live kind install was skipped; the parent integration workflow was still running at inspection. The PR also reports AMD64/ARM64 object upload/read/delete and bucket-privacy checks, which are author-reported evidence. This automation ran no containers, builds or tests and did not verify image layers, live Kubernetes startup, or existing-volume migration.

[bernhardkaindl]

With the used minio images not present on the docker hub (anymore), the changes to deploy/compose/compose.yml are required (as given in this PR with the sha, in full) to start the relay, the other changes seem to correspond, AFAICS.