Complete EMAIL-WP-0004 transactional invitation mail delivery.

Ship the railiance01 deploy package (OpenBao/ESO custody, NetworkPolicy,
probes), provider failure classification and suppression, T04 unit and live
proof, and non-secret NK-WP-0024 hand-back evidence. Workplan finished.

deploy/k8s/railiance/deployment.yaml

@@ -0,0 +1,97 @@
+# email-connect transactional receiver — railiance01 (EMAIL-WP-0004-T03).
+#
+# Conventions match audit-core / user-engine: digest-pinned image from
+# forgejo.coulomb.social, non-root, read-only root, probes on named http port.
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: email-connect
+  namespace: email-connect
+  labels:
+    app.kubernetes.io/name: email-connect
+    app.kubernetes.io/part-of: email-connect
+  annotations:
+    email-connect.railiance.io/rollback-note: >-
+      SQLite schema is additive (CREATE TABLE IF NOT EXISTS + optional
+      canceled_at column). Rolling back to the previous digest keeps the
+      same store path; duplicate event_id rows remain authoritative.
+spec:
+  replicas: 1
+  revisionHistoryLimit: 5
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: email-connect
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: email-connect
+        app.kubernetes.io/part-of: email-connect
+    spec:
+      serviceAccountName: email-connect
+      securityContext:
+        runAsNonRoot: true
+        fsGroup: 10001
+        seccompProfile:
+          type: RuntimeDefault
+      terminationGracePeriodSeconds: 15
+      containers:
+        - name: email-connect
+          # Pin at release. T04 failure-matrix image (provider classification +
+          # suppression + redacted diagnostics), 2026-08-12.
+          image: forgejo.coulomb.social/coulomb/email-connect@sha256:a9de1994eea88502ec30ba7c2fc029ec901d873140d51e11d2c50e363a0578b1
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8080
+          envFrom:
+            - configMapRef:
+                name: email-connect-config
+            - secretRef:
+                name: email-connect-runtime
+                optional: false
+          resources:
+            requests:
+              cpu: 25m
+              memory: 64Mi
+            limits:
+              cpu: 250m
+              memory: 256Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 10001
+            runAsGroup: 10001
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: tmp
+              mountPath: /tmp
+          startupProbe:
+            httpGet: {path: /healthz, port: http}
+            periodSeconds: 3
+            failureThreshold: 20
+          readinessProbe:
+            httpGet: {path: /readyz, port: http}
+            periodSeconds: 10
+            timeoutSeconds: 2
+            failureThreshold: 3
+          livenessProbe:
+            httpGet: {path: /healthz, port: http}
+            periodSeconds: 20
+            timeoutSeconds: 2
+            failureThreshold: 3
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: email-connect-data
+        - name: tmp
+          emptyDir: {}