INFD-WP-0010-T02: pin service image ca75f0be (main-c228583) for the v14 release

Owner CI run 6 built forgejo.coulomb.social/coulomb/informed-decision
@sha256:ca75f0be03af0bd96a66b08d2949bdc2d16365a93ffabcd6593074b565e8f01b
from c228583. Verified read-only:
- zlib 1.3.2-r1 (floor check passes)
- installed modules equal the source at c228583
- 13/13 container checks
- Trivy 0 HIGH/CRITICAL; 2 UNKNOWN musl findings, the same as the live image

Pinned in admission.candidate.json and re-rendered service.candidate.json.
The runtime ConfigMap is unchanged (informed-decision-runtime-b488b96a0953).
This commit is the release's RELEASE_SHA. Nothing applied.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196

docs/evidence/2026-11-01-present-existing-release/container.json

@@ -0,0 +1,32 @@
+{
+  "status": "passed",
+  "image_id": "sha256:ca75f0be03af0bd96a66b08d2949bdc2d16365a93ffabcd6593074b565e8f01b",
+  "repo_digests": [
+    "forgejo.coulomb.social/coulomb/informed-decision@sha256:ca75f0be03af0bd96a66b08d2949bdc2d16365a93ffabcd6593074b565e8f01b"
+  ],
+  "checks_passed": 13,
+  "checks": [
+    "installed container entrypoint serves with projected configuration",
+    "non-root read-only runtime has no external network or published port",
+    "private config/database modes enforced; package installer absent",
+    "configured review refuses anonymous access and reports audit-unready status",
+    "private listener refuses anonymous lifecycle access and exposes no browser routes",
+    "public listener exposes no private workload route",
+    "a second writer cannot acquire the active evidence volume",
+    "synthetic uncertain intent and undelivered evidence remain explicit",
+    "consistent backup created while serving; overwrite refused",
+    "SIGTERM closes the serving writer without forced kill",
+    "restart preserves immutable content and unresolved submission without retry",
+    "separate restored volume preserves exact content and unresolved state",
+    "incomplete owner configuration exits before serving"
+  ],
+  "fixture_only": true,
+  "external_network": "none",
+  "content_snapshot_sha256": "7c377d9159da33bdc491f81a3444d3d581c1711664dcfbb6df2a6f899b49f425",
+  "native_identity_policy_audit_proven": false,
+  "published": false,
+  "deployed": false,
+  "factory_attempts": 0,
+  "paid_model_calls": 0,
+  "cleanup_complete": true
+}

docs/evidence/2026-11-01-present-existing-release/image-verification.json

@@ -0,0 +1,54 @@
+{
+  "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:ca75f0be03af0bd96a66b08d2949bdc2d16365a93ffabcd6593074b565e8f01b",
+  "tag": "main-c228583",
+  "source_revision": "c228583b609aaa7f0e45ea1fcda4f26e121ad2c5",
+  "built_by": "owner CI service-image.yaml run 6 (success)",
+  "verified_read_only_2026-11-01": {
+    "label_revision_matches": true,
+    "user": "10001:10001",
+    "zlib_floor": "apk info --exists 'zlib>=1.3.2-r1' passed; zlib-1.3.2-r1, runtime 1.3.2",
+    "libuuid": "2.42.3-r1",
+    "pip_absent": true,
+    "runtime_smoke": {
+      "uid": 10001,
+      "zlib_runtime_version": "1.3.2",
+      "compression_vectors_pass": 4,
+      "malformed_zlib_refusals": 3,
+      "crypto_jwt_waitress_smoke": true,
+      "network_accessed": false,
+      "database_opened": false
+    },
+    "installed_modules_equal_source_at_c228583": true,
+    "container_checks": "13/13 passed (tools/smoke_container.py --workload), see container.json"
+  },
+  "scan": {
+    "scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
+    "scanners": "vuln",
+    "os": {
+      "Family": "alpine",
+      "Name": "3.24.1"
+    },
+    "db_updated_at": "2026-11-01T07:08:40Z",
+    "high_critical_findings": 0,
+    "findings": [
+      {
+        "id": "CVE-2026-107891",
+        "package": "musl",
+        "installed": "1.2.6-r2",
+        "fixed": "1.2.6-r3",
+        "severity": "UNKNOWN"
+      },
+      {
+        "id": "CVE-2026-107891",
+        "package": "musl-utils",
+        "installed": "1.2.6-r2",
+        "fixed": "1.2.6-r3",
+        "severity": "UNKNOWN"
+      }
+    ],
+    "exit_code": 0,
+    "report_sha256": "72a31d2435ac8b65925ffc5548d72419492334426f0b91ff5b9d707618485ca6",
+    "note": "The two UNKNOWN musl findings are also present in the live image f5588f49 (musl 1.2.6-r2): not a regression."
+  },
+  "deployed": false
+}