Add workbench-session-complete image

[ianpittwood]

Summary

Moves session-complete from images-specialized into this repo as workbench-session-complete. The image is copied at its latest version, 2026.09 (2026.09.0+174.pro3).

The image is workbench-session (ubuntu-26.04-{std,min}) with the full Workbench deb installed. Its session components are built in, so sessions run without a workbench-session-init init container.

• Build and publish: a new build-complete job in session.yml builds it after the workbench-session matrix, so it uses the freshly rebuilt base. production.yml excludes it with the image-name filter ^(?!workbench-session-complete$). It publishes to docker.io/posit/workbench-session-complete and ghcr.io/posit-dev/workbench-session-complete.
• Templates: the template and test files are unchanged. Re-rendering gives identical output, apart from the image's directory path in the COPY line.
• Platform: Ubuntu 26.04, linux/amd64 and linux/arm64. images-specialized built amd64 only because the template hardcoded the x86_64-linux-gnu path to libnss_pwb.so.2. The arm64 rstudio-server deb's postinst already links aarch64-linux-gnu, so the Containerfile and goss suite now take the triplet from uname -m.

Rolling release

bakery.yaml keeps only the latest Workbench version. A new release-session-complete job in release.yml runs after the shared product-release job. It works on the same release/<version> branch, so the change lands in the same release PR.

Release type	Action
Same-edition patch (2026.09.0 → 2026.09.1)	bakery update version in place
New edition (2026.09 → 2026.10)	bakery create version --mark-latest, then bakery remove version on the old one
Older-edition backport	Skipped

The README tag examples use the short version form (e.g. 2026.09.0-ubuntu-26.04), so the README rewrite in product-release keeps them current.

Testing

• bakery update files renders matching output, and bakery get tags shows the expected Docker Hub and GHCR tags.
• I ran the patch and new-edition bakery commands in a scratch copy. Each left exactly one version, with the OS and platform config kept.
• pre-commit passes, including actionlint and shellcheck.
• Not yet tested: the image build and dgoss on either architecture (left to PR CI), and the new release job end to end (it needs the GitHub App token).

Before merging

• Docker Hub repository posit/workbench-session-complete exists, and the push token can write to it.
• After the first push, make the GHCR package public.

Follow-up

Remove session-complete from images-specialized, both the image and its entry in that repo's release.yml.