fix(console): pin Beta channel to a versioned release, default ACP deploys to it

[brettchien]

Summary

• resolve_vendor_image_tags's "Beta" now resolves to the newest beta-named release (<version>-beta.N) confirmed to have a matching GHCR image, instead of the rolling pre-beta-<vendor> moving tag — matches the same verify-don't-infer pattern Stable already used, and gives callers/humans an actual version number to reason about.
• The New Fleet wizard's ACP checkbox and Image tag select had zero linkage — checking ACP with the default (Stable) selection silently sends whatever Stable currently resolves to. Stable is pinned to 0.9.0 right now (no 0.10.0 GA has cut yet), which predates ACP being wired as a first-class adapter (openab#1418, first in 0.10.0-beta.2) — reproducing the exact "no adapter configured" crash currently hitting Nike in openab-studio. The console now defaults the Image tag select to Beta the moment ACP is checked (and re-applies on every toggle).
• Add-instance on an existing k8s fleet now actually works. studio#152 blocked it outright (to stop a silent wrong-provider ECS deploy) rather than wiring it — this PR wires it instead: DeployMode's add-instance variant now carries the target fleet's existing runtime/context/namespace/expected_principal (already available on FleetConfigEntry), and a new currentK8sTarget() helper in deploy.ts is the single place deciding whether a submit targets k8s, for both new-fleet (reads the identity step's live fields) and add-instance (reads the fleet's existing binding — a k8s fleet's placement is fixed at creation, so this wizard never re-asks). No backend change needed — deploy_provision_agent/provision_agent_k8s already rebuild the manifest fresh on every call.

Context

Diagnosed live in the oab-studio/openab-studio k8s namespaces incident thread — Nike's CrashLoop is 0.9.0-claude + ACP enabled, and Brett hit the "Add instance isn't supported yet" dead end trying to redeploy it through the console. Confirmed via gh api repos/openabdev/openab/releases that openab-0.9.0 (2026-07-20) is genuinely the newest non-beta release; 0.10.0-beta.1/2/3 are all that's shipped since — not a resolution-logic bug, the gap was purely the missing ACP↔image-version guard plus the blocked add-instance path.

Test plan

• cargo check -p oabctl — compiles clean
• cargo test -p oabctl vendor_images — new unit tests for stable_release_versions/beta_release_versions cover the beta/stable split against a real release-list snapshot (prerelease: false on a beta-named tag included, matching the known-unreliable-flag case) — local run hit an OOM on this box building the full aws-sdk-ec2 test-cfg dep tree unrelated to this change; deferring to CI
• npx tsc --noEmit — clean
• npx vitest run — 107/107 passing (no existing test file covers deploy.ts itself — it's DOM/Tauri-invoke coupled, consistent with its existing test coverage)
• Manual: open New Fleet wizard, pick Claude vendor, check ACP → Image tag should jump to Beta automatically
• Manual: drill into an existing k8s fleet, click "+ Add instance" → should reach the compose step (not the old info-toast dead end) and provision into that fleet's actual context/namespace

🤖 Generated with Claude Code