Pin reuse-surface to a Forgejo image that actually exists (REUSE-WP-0020-T05)

image.tag was "e3ae22e", a Gitea-era tag. charts/reuse-surface/values.yaml was
repointed to the Forgejo repository in 04be416, but no e3ae22e tag was ever
published there — CI only began pushing to Forgejo three hours after that
commit. Authenticated tags/list returns latest, main-b035664, main-bca7165,
main-f9d957a. So the release could not pull its image, making ImagePullBackOff
a present risk on any restart rather than one tied to the 2026-08-31 CoulombCore
retirement.

Pin main-b035664, verified to resolve (manifest 200). It is a CI build of
reuse-surface main and carries the compose hardening that stops a single
malformed member index from returning HTTP 500 for the whole federated index —
needed before evidence-binder can be re-enabled as a source.

Also ships REUSE-WP-0019 T04/T05/T06, closed as finished but never deployed.

Not applied. Deploy is the manual `make reuse-deploy`, which needs
KUBECONFIG for Railiance01.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

helm/reuse-surface-values.yaml

@@ -4,7 +4,13 @@
 # See docs/reuse-surface-on-railiance01.md#runtime-secrets
 
 image:
-  tag: "e3ae22e"
+  # Was "e3ae22e" — a Gitea-era tag that does NOT exist in the Forgejo registry
+  # (tags/list: latest, main-b035664, main-bca7165, main-f9d957a). The pinned
+  # value could not be pulled, so any restart risked ImagePullBackOff.
+  # main-b035664 is a CI build of reuse-surface main and includes the compose
+  # hardening that keeps one malformed member index from 500-ing the federated
+  # endpoint. See REUSE-WP-0020-T05.
+  tag: "main-b035664"
 
 landing:
   enabled: true