Switch receiver rollout to Recreate and pin bounded-readyz image

RollingUpdate maxSurge cannot schedule a second 50m pod on a node
packed to 99% CPU requests. Recreate replaces in place; the Service
already has no ready endpoints.

Image sha256:ec15f63d… is commit bc3d80f. Local release check passed
against disposable Postgres. No schema migration. Live Ready still
depends on a fresh runtime lease from ESO/OpenBao.

Assistant: grok
Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082

deploy/README.md

@@ -8,7 +8,7 @@ the server port or export a copy before applying.
 Apply order is documented in `docs/operator-runbook.md`. Do not apply the
 Deployment until:
 
-1. The image digest is pinned (currently `sha256:c2fe39a0…` from commit `abd22fa`).
+1. The image digest is pinned (currently `sha256:ec15f63d…` from commit `bc3d80f`).
 2. Secrets `audit-core-database`, `audit-core-database-migrate`, and
    `audit-core-senders` exist. ConfigMap `audit-core-senders-scope` is
    applied (`deploy/senders-scope.yaml`) before the Deployment mounts it.

deploy/audit-core.yaml

@@ -55,10 +55,10 @@ spec:
   replicas: 1
   revisionHistoryLimit: 5
   strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 0
-      maxSurge: 1
+    # Recreate, not RollingUpdate: the node is packed to 99% CPU requests, so
+    # maxSurge: 1 cannot schedule a second 50m pod. The Service already has no
+    # ready endpoints, so replacing in place does not add a delivery gap.
+    type: Recreate
   selector:
     matchLabels:
       app.kubernetes.io/name: audit-core
@@ -86,7 +86,7 @@ spec:
         - name: audit-core
           # REPLACE at release time with the built digest. A mutable tag is not
           # an immutable image, and `:latest` must never be the only reference.
-          image: forgejo.coulomb.social/coulomb/audit-core@sha256:c82e0442de0fd181342916ae9cd5d6de41d859e1efda637bd93936c67873afa5
+          image: forgejo.coulomb.social/coulomb/audit-core@sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615
           imagePullPolicy: IfNotPresent
           ports:
             - name: http

deploy/migrate-job.yaml

@@ -33,7 +33,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: migrate
-          image: forgejo.coulomb.social/coulomb/audit-core@sha256:c82e0442de0fd181342916ae9cd5d6de41d859e1efda637bd93936c67873afa5
+          image: forgejo.coulomb.social/coulomb/audit-core@sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615
           imagePullPolicy: IfNotPresent
           command: ["python", "-m", "audit_core", "migrate"]
           env:

docs/evidence/2026-09-14-readyz-receiver-release.json

@@ -0,0 +1,40 @@
+{
+  "image": "forgejo.coulomb.social/coulomb/audit-core:bc3d80f",
+  "native_credentials_used": false,
+  "checks": {
+    "operational_ready": true,
+    "nonroot_readonly": true,
+    "approval-engine": {
+      "accepted": 202,
+      "duplicate": 200,
+      "wrong_source": 400,
+      "wrong_tenant": 400,
+      "read_routes_denied": 7,
+      "independent_read": 200,
+      "redacted": true,
+      "stored_once": true
+    },
+    "informed-decision": {
+      "accepted": 202,
+      "duplicate": 200,
+      "wrong_source": 400,
+      "wrong_tenant": 400,
+      "read_routes_denied": 7,
+      "independent_read": 200,
+      "redacted": true,
+      "stored_once": true
+    },
+    "sigterm": {
+      "exit_code": 0,
+      "inflight_committed_once": true,
+      "restart_retry_duplicate": true,
+      "chain_intact": true
+    }
+  },
+  "started_at": "2026-09-14T20:59:17.605971+00:00",
+  "status": "passed",
+  "own_fixture_cleanup": true,
+  "source_commit": "bc3d80fbd9a23e987d0b775cffcf9d388fc94aa4",
+  "registry_digest": "sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615",
+  "strategy": "Recreate"
+}