Implement bounded browser service, consumer evidence and managed package

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13590-a16f-7f60-be60-fd71627bc99d

tools/render.py

@@ -0,0 +1,18 @@
+#!/usr/bin/env python3
+"""Render only a supplied immutable image; no floating defaults can deploy."""
+import os
+from pathlib import Path
+import re
+
+image = os.environ.get('IMAGE_REFERENCE', '')
+if not re.fullmatch(r'forgejo\.coulomb\.social/coulomb/rapp-playwright@sha256:[a-f0-9]{64}', image):
+    raise SystemExit('IMAGE_REFERENCE must be the published rapp-playwright sha256 reference')
+source = Path('manifests/workload.yaml').read_text()
+rendered = source.replace('${IMAGE_REFERENCE}', image)
+if '${' in rendered:
+    raise SystemExit('unresolved template field')
+out = Path('.rendered')
+out.mkdir(exist_ok=True)
+(out / 'workload.yaml').write_text(rendered)
+(out / 'namespace.yaml').write_text(rendered.split('---',1)[0])
+print(out / 'workload.yaml')