[devscripts] Add opt-in token-free deploy (OPENSHIFT_CI, ephemeral registry)

[pinikomarov]

What

Add an opt-in token-free GA deploy path to the devscripts role, using
dev-scripts' own documented OPENSHIFT_CI=true mode, and neutralize its one
unwanted side effect (a persistent NFS image registry) so a single-host
reproducer stays green.

Why

dev-scripts hard-requires a valid app.ci CI_TOKEN for every non-okd release,
GA included — there are three touchpoints:

• validation.sh aborts on an empty token;
• validation.sh runs a live oc login to app.ci when the token is non-empty;
• utils.sh write_pull_secret (from 03_build_installer) logs in to app.ci to
  fetch registry creds for the pull-secret.

For a GA cluster the token is not needed to pull images — they come from the
pull-secret (quay.io / registry.redhat.io), not app.ci.

How

OPENSHIFT_CI=true (see dev-scripts config_example.sh) bypasses both the
token validation and the app.ci pull-secret login in a single documented switch.
Patching each gate individually was a dead end — the previous revision of this PR
missed write_pull_secret.

OPENSHIFT_CI=true also forces an NFS-backed persistent image registry that a
single-host reproducer does not provision (the deploy then stalls on
wait-for-stable-cluster). New opt-in default
cifmw_devscripts_skip_persistent_imageregistry (default false) rewrites the
single PERSISTENT_IMAGEREG=true line in common.sh to =false, keeping the
in-cluster registry on emptyDir. An assert fails early if that line is
absent, so a future dev-scripts bump cannot silently drop the patch.

Enable token-free deploy

cifmw_devscripts_config_overrides:
  openshift_ci: "true"
cifmw_manage_secrets_citoken_content: ''
cifmw_devscripts_skip_persistent_imageregistry: true

Test

Proven green on a clean single host (m37-09, 2026-10-08): token-free make all
reached "Install complete!"; 34/34 cluster operators Available=True / 0 Degraded;
oc adm wait-for-stable-cluster passed (no NFS hang); all pod images sourced
from quay.io + registry.redhat.io, zero from registry.ci/app.ci.

Related-Issue: #OSPRH-38514

🤖 Generated with Claude Code

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign fultonj for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[centosinfra-prod-github-app]

Build succeeded (check pipeline).
https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/3177e3752fe6451ea74476fa4864b18e

✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 20m 50s
✔️ podified-multinode-edpm-deployment-crc SUCCESS in 1h 19m 14s
✔️ podified-multinode-edpm-deployment-crc-centos-10 SUCCESS in 1h 20m 03s
✔️ cifmw-crc-podified-edpm-baremetal SUCCESS in 1h 37m 03s
✔️ cifmw-pod-zuul-files SUCCESS in 5m 17s
✔️ noop SUCCESS in 0s
✔️ cifmw-pod-ansible-test SUCCESS in 8m 32s
✔️ cifmw-pod-pre-commit SUCCESS in 8m 36s
✔️ cifmw-molecule-devscripts SUCCESS in 10m 11s

[centosinfra-prod-github-app]

Build succeeded (check pipeline).
https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/1bf67ea7535c4d16abcf401a12c64cfc

✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 21m 51s
✔️ podified-multinode-edpm-deployment-crc SUCCESS in 1h 18m 46s
✔️ podified-multinode-edpm-deployment-crc-centos-10 SUCCESS in 1h 21m 27s
✔️ cifmw-crc-podified-edpm-baremetal SUCCESS in 1h 32m 08s
✔️ cifmw-pod-zuul-files SUCCESS in 4m 29s
✔️ noop SUCCESS in 0s
✔️ cifmw-pod-ansible-test SUCCESS in 8m 40s
✔️ cifmw-pod-pre-commit SUCCESS in 7m 53s
✔️ cifmw-molecule-devscripts SUCCESS in 10m 32s