feat(009): pin the Deployment to the fleet placement-enablers image

.derived/codebase-index/by-spec/009-control-plane-deploy.json

@@ -115,5 +115,5 @@
     "specStatus": "approved"
   },
   "schemaVersion": "1.1.0",
-  "shardHash": "921b56b33fbbc47ab67416fec2c146adf2bc1cf1813d9ee48b153b21f6812354"
+  "shardHash": "9bec63df43711127b108b79d94618c0aa093c55316c9366a2e386a13c01e458f"
 }

.derived/spec-registry/by-spec/009-control-plane-deploy.json

@@ -61,13 +61,14 @@
       "Amendment (2026-07-22): re-pin to the spec 012 image",
       "Amendment (2026-07-22): spec 012 frontend-admin adoption, deploy env",
       "Amendment (2026-07-22, second pin): the spec 011 walk-fix image",
-      "Amendment (2026-07-22): fleet placement RBAC"
+      "Amendment (2026-07-22): fleet placement RBAC",
+      "Amendment (2026-07-23, third pin): the fleet placement enablers"
     ],
     "specPath": "specs/009-control-plane-deploy/spec.md",
     "status": "approved",
     "summary": "Stand the control plane up on the spec 010 cluster as a platform-grade K8s deployment at app.statecraft.ing. Rewritten ground-up 2026-07-19 to the two-plane thesis (001 section 3), which unpauses it. The rewrite inverts the deploy's job: the published image is embedded-rauthy and self-seeds its own identity on first boot, so the shared-rauthy secret set is void, five of the eleven Encore secrets are discarded by the entrypoint if injected, and the /data volume becomes the identity anchor of the platform. What the deploy still owes the container: nine real secrets, the non-secret env, a Postgres URL, an ingress, and one seeder pass for the only thing first boot cannot seed (the upstream GitHub provider, which rauthy has no declarative bootstrap for). Operator surfaces gate on the custom statecraft_operator role, seeded here; rauthy_admin stays break-glass. Live bring-up is a human checkpoint.\n",
     "title": "The control-plane deploy: one governed container on the statecraft cluster"
   },
-  "shardHash": "5becd8699f22edf419ce219bc450f8db5626707821e7073ea8785a2af538c78d",
+  "shardHash": "4bcd52b92635c9f86e3d049aae829eae39ef21ba4a683e0395299707c0b89cf0",
   "specVersion": "1.1.0"
 }

infra/gitops/clusters/statecraft-hetzner/statecraft/deployment.yaml

@@ -53,14 +53,14 @@ spec:
         - name: statecraft
           # Pinned by digest, never `:latest`. The tag is recorded alongside
           # for human legibility only; the digest is what is deployed.
-          # tag: dfe27c1 (012-frontend-admin-adoption merge, 2026-07-22) - the
-          # operator dashboard adoption (spec 012): backend/obs/ (/metrics +
-          # the trace plane), backend/admin/ + the frontend-admin bundle gated
-          # on statecraft_operator, app-model.json in the image, and the spec
-          # 011 tenant-lifecycle code's first deploy (its user_account ALTER
-          # was applied to the live database before this pin). The prior
-          # digest (e4cc8b90, built from 4d0a392) is the Sec-Fetch proxy fix.
-          image: ghcr.io/statecrafting/statecraft@sha256:aeefe20382eb47fb85a9de077cb41f5ac0341e1fbdecba025381fa1c87c573d1
+          # tag: 676b642 (006-fleet-port-pullsecret merge, 2026-07-23) - the
+          # fleet placement enablers (spec 006 amendment): the deploy-chosen
+          # container port (persisted on fleet_app; its BIGINT ALTER was
+          # applied to the live database before this pin) and the code that
+          # reads the FLEET_IMAGE_PULL_SECRET env set below. The prior
+          # digest (aeefe203, built from dfe27c1) is the spec 012 operator
+          # dashboard adoption.
+          image: ghcr.io/statecrafting/statecraft@sha256:f9fa57c924d8f579c982bf792bc8e9d5575f74e6a351c7a9ffa4288a4cfdeb4f
           imagePullPolicy: IfNotPresent
           # Fail-loud (spec 009 section 4.2, built 2026-07-23). Encore's
           # $env-bound secrets resolve absent-as-empty and are read lazily, so

specs/009-control-plane-deploy/spec.md

@@ -1271,3 +1271,15 @@ get/list/create; deployments, services, PVCs, jobs, ingresses,
 networkpolicies full lifecycle), and its ClusterRoleBinding; the
 Deployment's pod template adopts the ServiceAccount. A ClusterRole
 because tenant namespaces (`t-<tenantId>`) are dynamic.
+
+## Amendment (2026-07-23, third pin): the fleet placement enablers
+
+The Deployment moves to digest `f9fa57c9` (tag `676b642`, the PR #65
+merge). It carries the spec 006 amendment's deploy-chosen container port
+(persisted on `fleet_app`; the `BIGINT` ALTER was applied to the live
+database before this pin, so no ordering window existed) and the code
+that reads `FLEET_IMAGE_PULL_SECRET`, which the same PR added to this
+Deployment's env (section 4.4 note). One secret-shaped delta rides the
+manifest rather than the pod Secret: `FLEET_IMAGE_PULL_SECRET` is a
+resource name and travels as plain env. The digest change rolls the pod
+by itself (Recreate); no pod delete is needed.