Correct a premature verified, and survive credential rotation

I recorded readiness_state: verified after a passing smoke run and found the
deployment 0/1 eight hours later.

Platform credentials are 30-minute leases, not passwords. The service read the
mounted URL once at start-up and never again, so External Secrets kept the file
current while the engine held the URL it booted with, and every reconnection
after the first lease expiry used a credential the database had already
revoked.

/readyz reported it accurately — "database unreachable: OperationalError" — and
the pod sat unready for eight hours without being restarted, because liveness
is deliberately independent of the database. That separation behaved exactly as
designed: the process was alive and could not serve, and it said so.

Fixed in 0.1.5: the engine re-reads the credential for every new connection and
pool_recycle is 900s, well inside the lease. Only username and password come
from the refreshed URL; host, port and database come from the engine, so a
malformed refresh cannot silently redirect the service.

readiness_state back to deployed. The bar for verified is now observation
across a full lease rotation, because a smoke run inside the first window
cannot distinguish a service that works from one that works once — an
availability property is not provable by a single sample.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Bjefh8NUiEiahN4JLwoSKM

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 388925@bnt-lap001
Assistant-Session: 3507023f-e0fd-4a1e-9d90-a0d4217d1502

declarations/rapp.yaml

@@ -4,7 +4,7 @@ rapp_id: rapp-canned-prompts
 repo: rapp-canned-prompts
 ownership_repo: canned-prompts
 contract_version: 1.0.0
-readiness_state: verified
+readiness_state: deployed
 workload_identity:
   name: canned-prompts
   package_type: manifest-managed-platform-service
@@ -34,11 +34,11 @@ composition:
   upstream_components:
     - name: canned-prompts
       source: forgejo.coulomb.social/coulomb/canned-prompts
-      # Published 2026-09-07 from canned-prompts service/Dockerfile, tag 0.1.4.
+      # Published 2026-09-07 from canned-prompts service/Dockerfile, tag 0.1.5.
       # Pinned by digest rather than tag: a tag can be moved, and
       # live-image-digest-match would then pass against something that is no
       # longer what this repo reviewed.
-      version: sha256:2fbac3c0d1609a76d9478e540ae5450c5425e8c04e0565cccc6a4eb0180ebcaf
+      version: sha256:14c7b92f20d63f2e70ea17b0b45d3c483521fbbaf14ee5bc277fa541e10452e2
 rollout_contract:
   default_mode: kubectl-server-side-apply
 smoke_contract: