Operate scheduled chain-head attestation (AUDIT-WP-0009-T12)

Apply the separate attestor identity, named-ConfigMap RBAC, attest
egress and daily CronJob. Bootstrap an empty chain-head ConfigMap
only because it was absent; drop the placeholder from the apply path
so a later apply cannot overwrite a live head. One-shot job published
a 59-event attestation; mounted readback and receiver write-denial
passed. Offsite copy stays the operator path.

Assistant: grok
Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082

deploy/attest-cronjob.yaml

@@ -105,7 +105,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: attest
-              image: forgejo.coulomb.social/coulomb/audit-core@sha256:c82e0442de0fd181342916ae9cd5d6de41d859e1efda637bd93936c67873afa5
+              image: forgejo.coulomb.social/coulomb/audit-core@sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615
               imagePullPolicy: IfNotPresent
               command:
                 - python
@@ -126,7 +126,9 @@ spec:
                 - name: AUDIT_CORE_AUTO_MIGRATE
                   value: "0"
               resources:
-                requests: {cpu: 50m, memory: 64Mi}
+                # 10m so a one-shot proof job can schedule on a node packed
+                # to 99% CPU requests; 50m would Pending (Insufficient cpu).
+                requests: {cpu: 10m, memory: 64Mi}
                 limits: {cpu: 500m, memory: 256Mi}
               securityContext:
                 allowPrivilegeEscalation: false
@@ -146,18 +148,9 @@ spec:
               secret:
                 secretName: audit-core-database
                 defaultMode: 0440
----
-# Created empty by the operator so the CronJob's Role needs no `create`, and
-# so the Deployment can mount it before the first run. An absent or undated
-# attestation degrades the claim rather than breaking the receiver — that is
-# T01's `no_attestation` path, and it is the correct behaviour on day one.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: audit-core-chain-head
-  namespace: audit-core
-  labels:
-    app.kubernetes.io/name: audit-core
-    app.kubernetes.io/component: attest
-data:
-  chain-head.json: "{}"
+# ConfigMap audit-core-chain-head is NOT in this file. Applying a placeholder
+# `{}` would overwrite a live attestation. Bootstrap once if absent:
+#   kubectl -n audit-core create configmap audit-core-chain-head \
+#     --from-literal=chain-head.json='{}'
+#   kubectl -n audit-core label configmap audit-core-chain-head \
+#     app.kubernetes.io/name=audit-core app.kubernetes.io/component=attest

deploy/networkpolicies.yaml

@@ -199,10 +199,10 @@ spec:
       ports:
         - {protocol: UDP, port: 53}
         - {protocol: TCP, port: 53}
-    # kube-apiserver. On this single-node k3s cluster the API server is the
-    # host itself, so this is a host-network destination rather than a pod
-    # selector; narrow it to the API port.
+    # kube-apiserver. In-cluster clients use kubernetes.default.svc:443;
+    # the host listener is 6443. Both, and no other ports.
     - ports:
+        - {protocol: TCP, port: 443}
         - {protocol: TCP, port: 6443}
 ---
 apiVersion: networking.k8s.io/v1