Pin verified dispatcher image and retain release evidence

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f

deploy/informed-decision/README.md

@@ -56,3 +56,12 @@ This is a per-decision data operation, not a deployment. Headless clients call
 8081 with the appropriate projected audience and the normal API idempotency key;
 they never request approval:approve or approval:consume. Automatic scanning and
 a public delegate endpoint are deliberately outside this worker's contract.
+
+
+Final candidate image (Forgejo commit 4a59b23):
+forgejo.coulomb.social/coulomb/state-hub-memo-dispatch@sha256:410fb6b6c9fd7a7ee0b63d727fd3249fb3ae13943421d6a5ce88b7ad2520bd2f
+
+Live observation: State Hub's API Service selects app=state-hub. This worker
+does not carry that label, so it cannot enter the API endpoints. At inspection
+there were no other State Hub NetworkPolicies; recheck effective selection before
+activation. Its own policy allows only DNS and the exact intake peer on 8081.

deploy/informed-decision/dispatcher.candidate.json

@@ -69,7 +69,7 @@
             "containers": [
               {
                 "name": "dispatcher",
-                "image": "forgejo.coulomb.social/coulomb/state-hub-memo-dispatch@sha256:a3b311ab99f08ab51a2919e72537ffb1176aad2448fa892bf1bf826e1a11161a",
+                "image": "forgejo.coulomb.social/coulomb/state-hub-memo-dispatch@sha256:410fb6b6c9fd7a7ee0b63d727fd3249fb3ae13943421d6a5ce88b7ad2520bd2f",
                 "securityContext": {
                   "allowPrivilegeEscalation": false,
                   "readOnlyRootFilesystem": true,