fix: publish release images to ECR

[zhukaihan]

Summary

• replace the expired DockerHub PAT login with short-lived GitHub OIDC credentials for the ops AWS account
• publish semantic-versioned release images to the ops ECR registry returned by the ECR login action
• use Amplitude's AWS credential, ECR login, and Buildx wrapper actions
• keep ECR repository ownership in amplitude/deploy; the release workflow only references the evaluation-proxy repository name

Publishing flow

evaluation-proxy release → ops ECR evaluation-proxy → platform ECR-to-DockerHub sync → amplitudeinc/evaluation-proxy

The repository is already declared by createRepo: true in amplitude/deploy. This PR does not duplicate that infrastructure definition or expose DockerHub credentials to the GitHub Actions runner.

Validation

• ./gradlew ktlintCheck test
• parsed .github/workflows/release.yaml as YAML
• git diff --check
• confirmed the referenced failed release stopped at DockerHub login because its PAT had expired

Platform dependencies

• the ops OIDC role gha-evaluation-proxy-release must have push access to the ECR repository
• the isolated sync service must map ECR evaluation-proxy to DockerHub amplitudeinc/evaluation-proxy and preserve the semantic-version tag

Application runtime code is unchanged.

---

Note

Medium Risk
Changes the release pipeline's auth and image destination; a misconfigured OIDC role or ECR repo would block releases until fixed, but application runtime code is untouched.

Overview
Release workflow no longer logs into Docker Hub with a PAT. It now requests id-token: write (and contents: read) so the job can assume AWS credentials in the ops account, log into Amazon ECR, and push semver-tagged evaluation-proxy images to the ECR registry from the login step.

Docker image metadata and push use ${{ steps.login-ecr.outputs.registry }}/evaluation-proxy instead of DOCKERHUB_USERNAME/evaluation-proxy, and the build/push step switches to Amplitude's configure-aws-credentials, amazon-ecr-login, and build-push-action wrappers.

^{Reviewed by Cursor Bugbot for commit cd5573a. Bugbot is set up for automated code reviews on this repo. Configure here.}