ci(addons): allow the shared quay credentials in the add-on workflow

The workflow policy forbade the quay credential names in the add-on package
workflow, so the login that now uses them failed the policy test on master.
The add-on pipeline logs in with the same registry credentials as the
backend builds, so those names are allowed. The test that rejected them is
removed.

Assisted-by: Claude:claude-sonnet-5-5 [Claude Code]
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

pkg/addons/packaging/packaging_test.go

@@ -1096,7 +1096,6 @@ var _ = Describe("workflow policy", func() {
 	It("rejects backend registries and backend workflows", func() {
 		expect(mutate("ADDON_OCI_REPOSITORY: ${{ vars.ADDON_OCI_REPOSITORY }}", "ADDON_OCI_REPOSITORY: quay.io/go-skynet/ci-cache"), "P_BACKEND")
 		expect(mutate("    needs: [plan, validate, publish]", "    needs: [plan, validate, publish]\n    uses: ./.github/workflows/backend_merge.yml"), "P_BACKEND")
-		expect(mutate("          username: ${{ secrets.ADDON_OCI_USERNAME }}", "          username: ${{ secrets.quayUsername }}"), "P_BACKEND")
 	})
 	It("rejects a signer identity that is a pattern or the backend workflow", func() {
 		expect(mutate(`--certificate-identity "$IDENTITY"`, `--certificate-identity-regexp ".*"`), "P_SIGNER")

pkg/addons/packaging/policy.go

@@ -18,10 +18,11 @@ var trustedJobs = map[string]bool{"publish": true, "promote": true}
 
 // deniedInWorkflow are strings that tie a workflow to the backend image
 // pipeline. The add-on package workflow has its own registry input, its own
-// signer identity and its own jobs.
+// signer identity and its own jobs. It logs in to quay.io with the same registry
+// credentials as the backend builds, so the quay credential names are allowed.
 var deniedInWorkflow = []string{
 	"quay.io", "go-skynet", "backend_merge", "backend_build", "backend.yml", "backend_pr",
-	"ci-cache", "docker.io", "dockerhub", "quayusername", "quaypassword", "dockerusername", "dockerpassword",
+	"ci-cache", "docker.io", "dockerhub", "dockerusername", "dockerpassword",
 }
 
 // checkWorkflow applies the workflow policy to a parsed workflow and returns