chore(deps): update konflux references

[red-hat-konflux-kflux-prd-rh02]

This PR contains the following updates:

Package	Type	Update	Change
quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta (source, changelog)	tekton-bundle	patch	0.12.2 → 0.12.3
quay.io/konflux-ci/tekton-catalog/task-clamav-scan (source, changelog)	tekton-bundle	digest	3203cd3 → 22fb08a
quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks (source, changelog)	tekton-bundle	digest	fa53ef4 → 4390141
quay.io/konflux-ci/tekton-catalog/task-roxctl-scan (source, changelog)	tekton-bundle	digest	4d48db2 → 8286d4d
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan	tekton-bundle	digest	4b1856e → 12239e6

---

Release Notes

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta)

v0.12.3

Version 0.12.3 only has relevant changes for the remote variants of this task.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Saturday (* * * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[rhartuv]

Pipeline failure cause

The Konflux PR PipelineRun fails during task resolution (before any task runs) with:

invalid tekton bundle ... task-rpms-signature-scan:0.2.2@sha256:12239e6...
the layer 0 does not contain a dev.tekton.image.apiVersion annotation

Root cause

MintMaker updated the rpms-signature-scan pin to:

quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2.2@sha256:12239e624c5bca759fc594bdefd3d4411a62c69bb4c29c5ad733b1e0d88fb8e9

That digest is not a Tekton task bundle. It is an OCI SARIF artifact (artifactType: application/sarif+json, layer sast_unicode_check_out.sarif), so Tekton correctly rejects it.

The previous digest is a valid Tekton bundle:

...@sha256:4b1856e41d087e53af26562fb16a490579777d9ff05af33011ce212d477c7cd5

This is a bad catalog/reference pin, not an application-code issue.

Fix

In both:

• .tekton/agent-eval-harness-pull-request.yaml
• .tekton/agent-eval-harness-push.yaml

revert only the rpms-signature-scan digest back to 4b1856e..., and keep the other Konflux reference updates.