chore: port wave CI to push to internal ECR SEC-1395

[ShahzebMahmood]

Summary

• ported wave CI to push to the new internal ECR alongside the legacy one
• tag-and-push.sh switched from jib (push) to jibDockerBuild (local) so the workflow handles all pushes
• legacy pushes (wave/app and nf-tower-enterprise/wave) preserved on [release] commits; new internal pushes go to internal/seqeralabs/wave/app and platform/wave

[ShahzebMahmood]

@bebosudo just wanted to check the below thing i came across:

1. wave is public but seqeralabs/actions is private with access limited to internal/private repos. so the seqeralabs/actions/push step fails to resolve. options: inline the action's logic here, make seqeralabs/actions public, or change wave's visibility. leaning towards inlining, any preference?
2. is platform/wave the right path for the new enterprise push, or different name?

[ShahzebMahmood]

Per the discussion in #private-devops (https://seqera.slack.com/archives/C085RGMMU68/p1778138691159789?thread_ts=1778074434.502459): wave is public and seqeralabs/actions is private, so the push action can't resolve.

Team agreed to inline the push logic for now and revisit once the actions repo is split out (SEC-1409). Inlined both seqeralabs/actions/push calls in 495c3e0 with comments in the workflow pointing at the original action SHA so we know where to revert.

CI should pass now since "Unable to resolve action 'seqeralabs/actions'" was the only blocker.

[bebosudo]

I'm not familiar with the wave repo release policy: each time a commit with [release] in the message is merged we build and push an image for enterprise customers as well?

one important change is required when pushing the image to the new enterprise location, LGTM otherwise

[ShahzebMahmood]

@bebosudo yeah, seems so from previous workflow launches. Last release was [release] v1.33.3 on 2026-04-28 and the image got pushed to nf-tower-enterprise/wave:v1.33.3 on the legacy ECR.