RPF-WP-0015: repair recovery preflight for attest-chain Job pods and current audit-core digest

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 680842@bnt-lap001
Assistant-Session: 54eb9e8e-7d6b-4f0c-b7a6-a6db62075883

scripts/audit-core-recovery-preflight.py

@@ -21,7 +21,7 @@ from typing import Any
 
 EXPECTED_IMAGE = (
     "forgejo.coulomb.social/coulomb/audit-core@"
-    "sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6"
+    "sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615"
 )
 EXPECTED_DB_KEYS = {"username", "password", "host", "port", "dbname"}
 
@@ -30,6 +30,18 @@ class PreflightError(RuntimeError):
     pass
 
 
+def serving_pods(pod_list: dict[str, Any]) -> list[dict[str, Any]]:
+    """Deployment pods only: audit-core attest-chain Job pods share the app label."""
+    return [
+        pod
+        for pod in pod_list.get("items", [])
+        if not any(
+            owner.get("kind") == "Job"
+            for owner in pod.get("metadata", {}).get("ownerReferences", [])
+        )
+    ]
+
+
 class Remote:
     def __init__(self, host: str) -> None:
         self.host = host
@@ -204,7 +216,7 @@ def common_state(remote: Remote, now: datetime) -> dict[str, Any]:
         ["-n", "audit-core", "get", "pods", "-l", "app.kubernetes.io/name=audit-core"],
         label="read audit-core pod metadata",
     )
-    pods = pod_list.get("items", [])
+    pods = serving_pods(pod_list)
     if len(pods) != 1:
         raise PreflightError(f"expected one audit-core pod, observed {len(pods)}")
     pod = pods[0]