Please address the comments from this code review:

## Overall Comments
- Hard-coding `BUILD_TAG` and `SHORTCOMMIT` to `0.0.0` / `0000000` in the workflows changes all image tagging semantics for every run; consider gating this behind an explicit experimental flag or matrix entry so normal CI still exercises real versioning metadata.
- The new workflow file `operator/.github/workflows/test-chart.yml` will never execute because GitHub only loads workflows from `.github/workflows`; if you intend this to run in CI, move it to the top-level workflows directory or otherwise mark it as an example/test-only file.
- Several experimental/analysis artifacts (e.g. `selfhosted.sh`, `.claude/*`, CSV result files) are now in the main tree; consider moving these under a clearly ignored/experimental path or excluding them from the main repo to avoid confusion and accidental usage in non-experimental environments.

## Individual Comments

### Comment 1
<location path=".github/workflows/build.yaml" line_range="605-610" />
<code_context>
-
-      - name: Push images
-        # Skip for external contributions.
+      - name: Push remaining images
+        # Main image already pushed to rhacs-eng by build-push-action.
+        # Push roxctl/central-db and copy main to stackrox-io.
</code_context>
<issue_to_address>
**suggestion (performance):** Avoid repeated registry logins inside the image-push loop

Since the same credentials and registries are used for all images, `registry_rw_login` only needs to run once per registry rather than on every iteration of the `for image in roxctl central-db` loop. Moving the login calls outside the loop would avoid redundant auth requests and slightly speed up and simplify the step.

Suggested implementation:

```
      - name: Push remaining images
        # Main image already pushed to rhacs-eng by build-push-action.
        # Push roxctl/central-db and copy main to stackrox-io.
        if: |
          github.event_name == 'push' || !github.event.pull_request.head.repo.fork
        env:
          QUAY_STACKROX_IO_RW_PASSWORD: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }}
        run: |
            source ./scripts/ci/lib.sh

            # Perform registry logins once before pushing any images to avoid
            # repeated logins inside the image-push loop.
            registry_rw_login "quay.io/rhacs-eng" "${QUAY_RHACS_ENG_RW_PASSWORD}"
            registry_rw_login "quay.io/stackrox-io" "${QUAY_STACKROX_IO_RW_PASSWORD}"

```

To fully implement the suggestion (avoid repeated logins inside the image-push loop), you should also:
1. In the remainder of this `run:` script block (not shown in the snippet), remove any `registry_rw_login` calls that are currently executed inside the `for image in roxctl central-db` loop and rely on the logins done at the top instead.
2. Ensure `QUAY_RHACS_ENG_RW_PASSWORD` is defined in the `env:` section for this step (or inherited from a higher scope) if it is not already available, e.g.:
   ```yaml
   env:
     QUAY_RHACS_ENG_RW_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }}
     QUAY_STACKROX_IO_RW_PASSWORD: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }}
   ```
3. Verify that the push/copy commands in the existing loop do not implicitly re-login, so that the new single-login behavior is effective.
</issue_to_address>

### Comment 2
<location path="image/rhel/Dockerfile" line_range="31-35" />
<code_context>
+# independently of binary changes. Package installs rarely change, but
+# binaries change every commit — this ordering avoids rebuilding packages
+# when only binaries change.
+FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} AS base-with-packages

 COPY signatures/RPM-GPG-KEY-CentOS-Official /
-COPY static-bin /stackrox/
-
+COPY static-bin/save-dir-contents /stackrox/save-dir-contents
+COPY static-bin/restore-all-dir-contents /stackrox/restore-all-dir-contents
+ENV PATH="/stackrox:$PATH"
 COPY --from=downloads /output/rpms/ /tmp/
</code_context>
<issue_to_address>
**suggestion:** The helper binaries copied into the base-with-packages stage appear to be unused

In this stage you copy `save-dir-contents` and `restore-all-dir-contents` into `/stackrox` and update `PATH`, but nothing in `base-with-packages` appears to invoke them. The final stage’s `COPY --link static-bin /stackrox/` will bring them in anyway. If they’re not needed during package installation, consider removing this `COPY` and `PATH` change here to avoid redundant copies and keep the Dockerfile simpler.

```suggestion
COPY signatures/RPM-GPG-KEY-CentOS-Official /
COPY --from=downloads /output/rpms/ /tmp/
```
</issue_to_address>

### Comment 3
<location path="scripts/ci/shard-packages.sh" line_range="15-16" />
<code_context>
+    exit 1
+fi
+
+SHARD_INDEX=$1
+TOTAL_SHARDS=$2
+shift 2
+
</code_context>
<issue_to_address>
**suggestion:** Validate shard index and total shard count to avoid surprising empty shards

Currently we only check the argument count, but not that `SHARD_INDEX` is in `[0, TOTAL_SHARDS)` or that `TOTAL_SHARDS` is > 0. If `SHARD_INDEX >= TOTAL_SHARDS` or `TOTAL_SHARDS <= 0`, this shard will silently emit no packages. Please add numeric validation and a range check early, and exit with a clear error message on invalid inputs.
</issue_to_address>

### Comment 4
<location path="selfhosted.sh" line_range="3-12" />
<code_context>
+#!/usr/bin/env bash
+
+RUNNER_TOKEN=$(gh api repos/davdhacs/stackrox-reduced/actions/runners/registration-token -X POST --jq '.token')
+echo $RUNNER_TOKEN
+
+docker run -it --rm \
+  --platform linux/amd64 \
+  -e DISABLE_AUTO_UPDATE=true \
+    -e RUNNER_NAME=colima-runner \
+    -e RUNNER_WORKDIR=/tmp/runner-work \
+    -e RUNNER_REPOSITORY_URL=https://github.com/davdhacs/stackrox-reduced \
+    -e REPO_URL=https://github.com/davdhacs/stackrox-reduced \
+    -e RUNNER_TOKEN="$RUNNER_TOKEN" \
+    -e RUNNER_REUSE=true \
+    -e LABELS=self-hosted \
+    myoung34/github-runner:latest
</code_context>
<issue_to_address>
**suggestion (bug_risk):** Self-hosted runner helper script mixes repo-specific details and lacks basic failure handling

This script is hardcoded to `davdhacs/stackrox-reduced` and assumes `gh` is present, configured, and always succeeds. If `gh api` fails or returns an empty token, the container still runs with an empty `RUNNER_TOKEN`, making failures hard to diagnose. Either parameterize the repo URL and bail out when `RUNNER_TOKEN` is empty, or move this into a clearly personal/local tooling path so others don’t depend on an environment-specific script.
</issue_to_address>

### Comment 5
<location path=".claude/mtime-bench/main_test.go" line_range="63-65" />
<code_context>
+			files[i] = f
+		}
+
+		b.Run(ts.name, func(b *testing.B) {
+			b.ResetTimer()
+			for b.Loop() {
+				h := sha256.New()
+				for _, f := range files {
</code_context>
<issue_to_address>
**issue (bug_risk):** Benchmarks use `b.Loop()` which does not exist on `testing.B` and will not compile

These benchmarks use `for b.Loop()` but `testing.B` does not define `Loop`, so this file will not compile and the benchmarks will never run. Please switch to the standard `for i := 0; i < b.N; i++ { ... }` loop (or an equivalent helper) in each benchmark so they run correctly under `go test -bench`.
</issue_to_address>

### Comment 6
<location path=".claude/mtime-bench/main_test.go" line_range="55-59" />
<code_context>
+
+	for _, ts := range timestamps {
+		files := make([]string, 50)
+		for i := range files {
+			f := filepath.Join(tmpDir, fmt.Sprintf("%s_%03d.go", ts.name, i))
+			content := fmt.Sprintf("package foo\nvar x%d = %d\n", i, i)
+			os.WriteFile(f, []byte(content), 0644)
+			os.Chtimes(f, ts.goTime, ts.goTime)
+			files[i] = f
+		}
</code_context>
<issue_to_address>
**suggestion (bug_risk):** Benchmark setup ignores I/O errors, which can make results misleading or hide failures

Within the benchmark setup (e.g., `BenchmarkStatAndHash`, `BenchmarkStatOnly`), the `os.WriteFile` and `os.Chtimes` calls ignore returned errors. If the temp dir isn’t usable (e.g., read-only FS, missing directory), the benchmarks will run with an invalid setup and produce misleading results. Please check these errors and fail the benchmark via `b.Fatalf` during setup when the environment isn’t as expected.

Suggested implementation:

```golang
		for i := range files {
			f := filepath.Join(tmpDir, fmt.Sprintf("%s_%03d.go", ts.name, i))
			content := fmt.Sprintf("package foo\nvar x%d = %d\n", i, i)
			if err := os.WriteFile(f, []byte(content), 0o644); err != nil {
				b.Fatalf("BenchmarkStatAndHash: failed to write temp file %q: %v", f, err)
			}
			if err := os.Chtimes(f, ts.goTime, ts.goTime); err != nil {
				b.Fatalf("BenchmarkStatAndHash: failed to change times for temp file %q: %v", f, err)
			}
			files[i] = f
		}

```

Apply the same pattern to any other benchmarks in this file that create temp files (e.g., `BenchmarkStatOnly`), wrapping their `os.WriteFile` and `os.Chtimes` calls in error checks and failing the benchmark with `b.Fatalf` on error. This keeps all benchmark setups consistent and ensures they abort on unusable environments.
</issue_to_address>