ci: bump image digests to ca21b6e70d

Built and scanned by ca21b6e70d. ArgoCD syncs from this commit.

[skip ci]

deploy/chart/values.yaml

@@ -9,7 +9,6 @@
 
 nameOverride: ""
 fullnameOverride: ""
-
 image:
   registry: gitea.oci-oci.duckdns.org
   pullPolicy: IfNotPresent
@@ -19,14 +18,13 @@ image:
   # deploy, which is the intended failure mode. Never hand-edit these.
   api:
     repo: gitea.oci-oci.duckdns.org/gitea_admin/svcforge-api
-    digest: sha256:0000000000000000000000000000000000000000000000000000000000000000
+    digest: sha256:ca2eb7cae9aac4d388b1c6cd8f44b402f271704a40585801092a1ab09d7b6608
   worker:
     repo: gitea.oci-oci.duckdns.org/gitea_admin/svcforge-worker
-    digest: sha256:0000000000000000000000000000000000000000000000000000000000000000
+    digest: sha256:f62c71d65a9fb78953d8005e1bca79ce760995f25b9725ab91d1a23b63224bf2
   reconciler:
     repo: gitea.oci-oci.duckdns.org/gitea_admin/svcforge-reconciler
-    digest: sha256:0000000000000000000000000000000000000000000000000000000000000000
-
+    digest: sha256:5a592ecef4df1c9a454652079777d537eefc975b158bbcc928e111f363eb0b4a
 api:
   replicas: 2
   # One process per pod. Module 7 took the "scale with replicas" fix over
@@ -47,7 +45,6 @@ api:
     tls:
       enabled: true
       secretName: svcforge-tls
-
 worker:
   # Plain replicas. No HPA: the day `replicas: 2` stops keeping up, not before.
   replicas: 2
@@ -55,7 +52,6 @@ worker:
   resources:
     requests: {cpu: 100m, memory: 192Mi}
     limits: {memory: 512Mi}
-
 reconciler:
   # A singleton, and not by convention — the four checks are not safe to run twice
   # concurrently. replicas is deliberately not a value: there is nothing to tune.
@@ -63,13 +59,11 @@ reconciler:
   resources:
     requests: {cpu: 50m, memory: 128Mi}
     limits: {memory: 256Mi}
-
 # Postgres pool sizing. replicas × maxSize is spent against the Supabase pooler budget:
 # api(2 × 5) + worker(2 × 5) + reconciler(1 × 2) = 22 connections. Raise with care.
 pool:
   minSize: 1
   maxSize: 5
-
 migrate:
   # backoffLimit: 0 — a failed migration must fail the release, not retry into a
   # half-applied schema. Migrations run here and only here; never on app startup.
@@ -77,19 +71,15 @@ migrate:
   resources:
     requests: {cpu: 50m, memory: 128Mi}
     limits: {memory: 256Mi}
-
 auth:
   jwksUrl: https://auth.oci-oci.duckdns.org/realms/svcforge/protocol/openid-connect/certs
   issuer: https://auth.oci-oci.duckdns.org/realms/svcforge
   audience: svcforge
-
 otel:
   enabled: true
   endpoint: http://alloy.observability.svc.cluster.local:4317
-
 log:
   level: info
-
 # The DSNs are pulled from Vault by external-secrets into a Secret the pods envFrom.
 # No DSN is ever a chart value, a ConfigMap key, or a CI variable.
 externalSecret:
@@ -110,7 +100,6 @@ externalSecret:
     - secretKey: SVCFORGE_REDIS_DSN
       key: svcforge/redis
       property: dsn
-
 rbac:
   # The worker helm-installs tenant releases into namespaces it creates. `namespaces` is a
   # cluster-scoped resource, so `create namespaces` cannot be granted by a namespaced Role
@@ -118,17 +107,14 @@ rbac:
   # verbs, no `*`, no cluster-admin, and no rbac.authorization.k8s.io group at all, so the
   # worker cannot grant itself anything further.
   create: true
-
 serviceAccount:
   create: true
   annotations: {}
-
 # Chart-native only. A hand-authored ServiceMonitor/PrometheusRule CR is banned — the
 # chart owns these, gated by these flags.
 serviceMonitor:
   enabled: true
   interval: 30s
-
 prometheusRule:
   enabled: true
   rules:
@@ -176,13 +162,11 @@ prometheusRule:
       annotations:
         summary: the svcforge reconciler has not ticked in 5 minutes
         runbook_url: https://gitea.oci-oci.duckdns.org/gitea_admin/svcforge/src/branch/master/RUNBOOK.md#orphaned-release
-
 # Not in the spec. Off by default: on a three-node k3s a PDB that cannot be satisfied
 # blocks drains, which is worse than the disruption it prevents.
 podDisruptionBudget:
   enabled: false
   minAvailable: 1
-
 nodeSelector: {}
 tolerations: []
 affinity: {}