feat(009): pin the Deployment to the fleet-native 0.2.0 image

[bartekus]

What

Fourth pin: the Deployment moves to digest 43717a27 (tag 5cbbded, the PR #67 merge). It carries exactly one change over f9fa57c9: the @statecrafting/fleet-native 0.2.0 pin, whose per-app ingress-allow NetworkPolicy ends the namespace-wide port pin the 2026-07-23 in-pod two-stage E2E surfaced (spec 006 amendment; the addon fix is statecrafting/statecrafting#12).

No schema delta, no new secret, no env change rides this pin; the digest change rolls the pod by itself (Recreate). Post-roll operator step, recorded in the spec 009 amendment: delete the stale hand-patched fleet-allow-ingress-nginx from the test tenant namespace.

Verification

• spec-spine compile / index / lint --fail-on-warn / couple: green, no drift, shards committed.
• Digest verified against the image.yml run for 5cbbded (both the sha tag and latest point at 43717a27...).

[github-actions]

AI Code Review

Spec Coupling

The pattern is correct: specs/009-control-plane-deploy/spec.md is authored, .derived/ shards are regenerated (shardHashes changed), and nothing in .derived/ appears hand-edited. No issue here.

Bugs / Editorial

Duplicate phrase in spec amendment (specs/009-control-plane-deploy/spec.md, last paragraph):

…(spec 006 amendment, statecrafting spec 006 amendment).

"statecrafting spec 006 amendment" is a copy-paste remnant — the parenthetical names the same thing twice. Minor but will persist in the permanent record.

Untracked Manual Step

The amendment documents a post-roll operator action:

Post-roll the operator deletes the stale hand-patched fleet-allow-ingress-nginx from the test tenant namespace

This is load-bearing (leaves a stale NetworkPolicy in place if skipped) but has no tracking artifact — no checklist item, no runbook reference, no follow-up spec task. If the hand-patched policy isn't deleted, the NetworkPolicy state in that namespace diverges from what fleet-native 0.2.0 expects to own. Consider a linked spec task or a kubectl one-liner in the amendment for the operator to confirm they ran.

Security

No issues. Digest pinning (sha256:…) is correct; no tag-only references; no new secrets introduced; imagePullPolicy: IfNotPresent is appropriate for a digest-pinned image.

Performance

Nothing to flag — purely a digest swap with no config or resource changes.

---

Automated review by Claude. Diff size: 33 lines.