Check a workload for an available upgrade

Check whether a single workload has a newer image available in its source registry. This is an offline metadata comparison; it does not pull images. Secret values are never returned.