Switch receiver rollout to Recreate and pin bounded-readyz image

RollingUpdate maxSurge cannot schedule a second 50m pod on a node
packed to 99% CPU requests. Recreate replaces in place; the Service
already has no ready endpoints.

Image sha256:ec15f63d… is commit bc3d80f. Local release check passed
against disposable Postgres. No schema migration. Live Ready still
depends on a fresh runtime lease from ESO/OpenBao.

Assistant: grok
Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082

docs/evidence/2026-09-14-readyz-receiver-release.json

@@ -0,0 +1,40 @@
+{
+  "image": "forgejo.coulomb.social/coulomb/audit-core:bc3d80f",
+  "native_credentials_used": false,
+  "checks": {
+    "operational_ready": true,
+    "nonroot_readonly": true,
+    "approval-engine": {
+      "accepted": 202,
+      "duplicate": 200,
+      "wrong_source": 400,
+      "wrong_tenant": 400,
+      "read_routes_denied": 7,
+      "independent_read": 200,
+      "redacted": true,
+      "stored_once": true
+    },
+    "informed-decision": {
+      "accepted": 202,
+      "duplicate": 200,
+      "wrong_source": 400,
+      "wrong_tenant": 400,
+      "read_routes_denied": 7,
+      "independent_read": 200,
+      "redacted": true,
+      "stored_once": true
+    },
+    "sigterm": {
+      "exit_code": 0,
+      "inflight_committed_once": true,
+      "restart_retry_duplicate": true,
+      "chain_intact": true
+    }
+  },
+  "started_at": "2026-09-14T20:59:17.605971+00:00",
+  "status": "passed",
+  "own_fixture_cleanup": true,
+  "source_commit": "bc3d80fbd9a23e987d0b775cffcf9d388fc94aa4",
+  "registry_digest": "sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615",
+  "strategy": "Recreate"
+}