Adds collect_live_cluster_versions() — enumerates pod container images via
kubectl and protects any forgejo.coulomb.social/coulomb/<name>:<tag>. Closes the
gap where CI-deployed apps (e.g. state-hub) pin a live tag absent from Helm
values. On by default (--no-protect-live to skip); emits protection_notes +
live_protection in the JSON summary so consumers can detect reduced coverage.
Verified against production: protects state-hub/vergabe/issue-core live tags.
ACTIVITY-WP-0020 T07 (partial — see workplan note re multi-cluster coverage).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
tegwick
e9e631fbf4