Prepare durable isolated Vergabe pilot deployment and recovery

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

charts/vergabe-teilnahme/values.yaml

@@ -1,10 +1,15 @@
 image:
   repository: forgejo.coulomb.social/coulomb/vergabe-teilnahme
   tag: ""             # required; pinned via helm/vergabe-teilnahme-values.yaml
+  digest: ""          # preferred; takes precedence over tag
   pullPolicy: IfNotPresent
 
 replicaCount: 1       # v1 is single-instance; HA is deferred (RAILIANCE-WP-0002 Notes)
 
+# An invited company pilot requires an immutable image and both data volumes.
+pilot:
+  enabled: false
+
 service:
   type: ClusterIP
   port: 80
@@ -19,8 +24,7 @@ resources:
     memory: 1Gi
 
 # Env from the K8s Secret created out-of-band (vergabe-teilnahme-env).
-# Holds SECRET_KEY + DATABASE_URL. Created by the operator with kubectl
-# create secret generic vergabe-teilnahme-env --from-literal=...
+# Holds SECRET_KEY + DATABASE_URL. Deliver via the admitted platform custody lane.
 envSecretName: vergabe-teilnahme-env
 
 # Non-secret env injected directly into the Deployment.
@@ -45,14 +49,21 @@ probes:
     timeoutSeconds: 5
     failureThreshold: 3
 
-# PVC for media uploads is deferred — Django MEDIA is in-pod ephemeral
-# for v1. Switch to true + a storageClass once media uploads land.
+# Existing installations remain opt-in. Pilot mode refuses ephemeral state.
+# PVCs are retained on Helm uninstall; a verified off-host backup is still required.
 persistence:
   media:
     enabled: false
     storageClass: local-path
     size: 5Gi
     accessMode: ReadWriteOnce
+    existingClaim: ""
+  appState:
+    enabled: false
+    storageClass: local-path
+    size: 1Gi
+    accessMode: ReadWriteOnce
+    existingClaim: ""
 
 podSecurityContext:
   runAsNonRoot: true