CLOUDP-329390: Tag latest readiness and versionhook when building on master (#205)

# Summary

This is another attempt at publishing latest tags of readiness probes
and versionhooks from CI after master merges. The previous attempt (#57)
was unsuccessful and was reverted.

This problem affects multi-arch images as they're not using sonar and
have multi-arch manifests pushed after sonar build in `pipeline.py`.
Single-arch images have latest images published via [sonar
inventory](https://github.com/mongodb/mongodb-kubernetes/blob/c242836b12a5108f69bb083b3bfb824e1977b4b8/inventories/database.yaml#L38)

Current approach adds logic checking if we're not building from a patch
(from PR or manually triggered evg pipeline) and in evg:

## Proof of Work

### Manual test
It's difficult to trigger "master" build from PR, so a manual test was
performed by changing the condition [here]
(https://github.com/mongodb/mongodb-kubernetes/pull/205/files#diff-6b92e3e77956f8020482ca91889a24f3411c9a4854f2aaaac30ee504ef26ede4R1012)
with changed tag to `latest-test`
We can see `latest-test` pushed
[here](https://parsley.mongodb.com/evergreen/mongodb_kubernetes_init_test_run_build_upgrade_hook_image_patch_c242836b12a5108f69bb083b3bfb824e1977b4b8_685507301df3100007f1d3ff_25_06_20_07_01_05/0/task?bookmarks=0%2C600&selectedLineRange=L595&shareLine=595)

### Build from PR
When building from PR it's not pushing tag:
[evg](https://parsley.mongodb.com/evergreen/mongodb_kubernetes_init_test_run_build_readiness_probe_image_patch_c242836b12a5108f69bb083b3bfb824e1977b4b8_68551d8d8be6120007ecfe96_25_06_20_08_36_31/0/task?bookmarks=0%2C551&selectedLineRange=L547&shareLine=547)

The final test will be performed after merging.

## Checklist
- [ ] Have you linked a jira ticket and/or is the ticket in the title?
- [ ] Have you checked whether your jira ticket required DOCSP changes?
- [ ] Have you checked for release_note changes?

## Reminder (Please remove this when merging)
- Please try to Approve or Reject Changes the PR, keep PRs in review as
short as possible
- Our Short Guide for PRs:
[Link](https://docs.google.com/document/d/1T93KUtdvONq43vfTfUt8l92uo4e4SEEvFbIEKOxGr44/edit?tab=t.0)
- Remember the following Communication Standards - use comment prefixes
for clarity:
  * **blocking**: Must be addressed before approval.
  * **follow-up**: Can be addressed in a later PR or ticket.
  * **q**: Clarifying question.
  * **nit**: Non-blocking suggestions.
  * **note**: Side-note, non-actionable. Example: Praise 
  * --> no prefix is considered a question

Author: lsierant

pipeline.py

@@ -1042,8 +1042,26 @@ def build_image_generic(
             # But since we don't run daily rebuilds on ecr image builds, we can do that step instead here.
             # We only need to push manifests for multi-arch images.
             create_and_push_manifest(registry_address, version, architectures=architectures)
+            latest_tag = "latest"
+            if not is_running_in_patch() and is_running_in_evg_pipeline():
+                logger.info(f"Tagging and pushing {registry_address}:{version} as {latest_tag}")
+                try:
+                    client = docker.from_env()
+                    source_image = client.images.pull(f"{registry_address}:{version}")
+                    source_image.tag(registry_address, latest_tag)
+                    client.images.push(registry_address, tag=latest_tag)
+                    span = trace.get_current_span()
+                    span.set_attribute("mck.image.push_latest", f"{registry_address}:{latest_tag}")
+                    logger.info(f"Successfully tagged and pushed {registry_address}:{latest_tag}")
+                except docker.errors.DockerException as e:
+                    logger.error(f"Failed to tag/push {latest_tag} image: {e}")
+                    raise
+            else:
+                logger.info(
+                    f"Skipping tagging and pushing {registry_address}:{version} as {latest_tag} tag; is_running_in_patch={is_running_in_patch()}, is_running_in_evg_pipeline={is_running_in_evg_pipeline()}"
+                )
 
-    # Sign and verify the context image if on releases if requied.
+    # Sign and verify the context image if on releases if required.
     if config.sign and config.is_release_step_executed():
         sign_and_verify_context_image(registry, version)
 
@@ -1607,7 +1625,6 @@ def calculate_images_to_build(
 
 def main():
     _setup_tracing()
-    _setup_tracing()
 
     parser = argparse.ArgumentParser()
     parser.add_argument("--include", action="append", help="list of images to include")