ip-algo: rename pod field to app; image from pod spec

The `pod` field hashed pod.Name, which differs per replica because of
the ReplicaSet pod-template-hash + 5-char random suffix. With
namespace,pod,image, all replicas of the same Deployment got distinct
hextets even though they were the same workload.

Replace `pod` with `app` — a stable workload identifier derived from
the controller chain:

  - Deployment → ReplicaSet → Pod: strip the pod-template-hash suffix
    from the RS name (`traefik-789df685f` → `traefik`).
  - StatefulSet/DaemonSet/Job → Pod: use controller name as-is.
  - Bare pod: pod name.

Image now comes from pod.Spec.Containers[0].Image (the spec'd
reference). 64-hex-char values are treated as sha256 digests and
parsed as before; everything else (image:tag, short SHA) is FNV-1a-64'd
as a string. This makes `traefik:v3.5` deterministic across replicas
without needing the runtime-resolved digest.

Net effect: namespace,app,image yields identical hextets across all
replicas of the same Deployment except the trailing random N nibble.

embed.Values.Pod → App; AllocRequest.Pod kept for log context only,
new App and Image fields drive the embed call. handlers.go computes
both via deriveAppName + podImageRef helpers.

Tests: 7 new TestDeriveAppName_* cases (Deploy/STS/DS/bare/RS-without-
hash/non-controller-owner) + TestPodImageRef. Existing fuzz seeds
updated for the new keyword.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

pkg/agent/ipam.go

@@ -67,7 +67,13 @@ func (cryptoRand) PickIndex(n int) int {
 type AllocRequest struct {
 	ContainerID string
 	Namespace   string
-	Pod         string
+	// Pod is the literal pod name (used for logging only — not embedded).
+	Pod string
+	// App is the stable workload identity for the FieldApp embed field —
+	// typically the owning Deployment / StatefulSet / DaemonSet name.
+	// Computed by the handler; falls back to Pod when no usable owner is
+	// found (bare pods).
+	App string
 	// WantV6 / WantV4 are the post-merge address family selection (pod
 	// annotation > NodeConfig.Spec.Defaults > built-in baseline of
 	// dual-stack). At least one MUST be true; Allocate rejects the request
@@ -78,12 +84,14 @@ type AllocRequest struct {
 	// means "use any of the node's CIDRs".
 	AnnCIDR6 []*net.IPNet
 	AnnCIDR4 []*net.IPNet
-	// IPAlgo comes from the ip-algo annotation. Empty means random IID.
+	// IPAlgo comes from the resolved ip-algo precedence chain. Empty means
+	// random IID.
 	IPAlgo []embed.Field
-	// ImageDigest is the sha256 manifest digest (with or without "sha256:"
-	// prefix). If empty, embed.Values.ImageFallback = ContainerID is used
-	// for ip-algo fields that reference image.
-	ImageDigest string
+	// Image is the spec'd image reference (typically
+	// pod.Spec.Containers[0].Image). When 64 hex chars, treated as a
+	// sha256 digest; otherwise FNV-1a-64'd as a string. Empty falls back
+	// to FNV(ContainerID) for ip-algo fields that reference image.
+	Image string
 }
 
 // AllocResult is what the IPAM hands back to the CNI ADD.
@@ -210,8 +218,8 @@ func (i *IPAM) allocV6(cidr *net.IPNet, req AllocRequest) (net.IP, error) {
 		} else {
 			ip, err = embed.Embed(cidr, req.IPAlgo, embed.Values{
 				Namespace:     req.Namespace,
-				Pod:           req.Pod,
-				Image:         req.ImageDigest,
+				App:           req.App,
+				Image:         req.Image,
 				ImageFallback: req.ContainerID,
 			}, i.randSrc.NibbleN())
 		}