feat(009): pin the Deployment to the fleet-native 0.2.0 image

.derived/codebase-index/by-spec/009-control-plane-deploy.json

@@ -115,5 +115,5 @@
     "specStatus": "approved"
   },
   "schemaVersion": "1.1.0",
-  "shardHash": "9bec63df43711127b108b79d94618c0aa093c55316c9366a2e386a13c01e458f"
+  "shardHash": "8010a5d918e39d1c9b7a5697e06b3dc24ad08bf992573fc73e6c18381cbdad8e"
 }

.derived/spec-registry/by-spec/009-control-plane-deploy.json

@@ -62,13 +62,14 @@
       "Amendment (2026-07-22): spec 012 frontend-admin adoption, deploy env",
       "Amendment (2026-07-22, second pin): the spec 011 walk-fix image",
       "Amendment (2026-07-22): fleet placement RBAC",
-      "Amendment (2026-07-23, third pin): the fleet placement enablers"
+      "Amendment (2026-07-23, third pin): the fleet placement enablers",
+      "Amendment (2026-07-23, fourth pin): fleet-native 0.2.0"
     ],
     "specPath": "specs/009-control-plane-deploy/spec.md",
     "status": "approved",
     "summary": "Stand the control plane up on the spec 010 cluster as a platform-grade K8s deployment at app.statecraft.ing. Rewritten ground-up 2026-07-19 to the two-plane thesis (001 section 3), which unpauses it. The rewrite inverts the deploy's job: the published image is embedded-rauthy and self-seeds its own identity on first boot, so the shared-rauthy secret set is void, five of the eleven Encore secrets are discarded by the entrypoint if injected, and the /data volume becomes the identity anchor of the platform. What the deploy still owes the container: nine real secrets, the non-secret env, a Postgres URL, an ingress, and one seeder pass for the only thing first boot cannot seed (the upstream GitHub provider, which rauthy has no declarative bootstrap for). Operator surfaces gate on the custom statecraft_operator role, seeded here; rauthy_admin stays break-glass. Live bring-up is a human checkpoint.\n",
     "title": "The control-plane deploy: one governed container on the statecraft cluster"
   },
-  "shardHash": "4bcd52b92635c9f86e3d049aae829eae39ef21ba4a683e0395299707c0b89cf0",
+  "shardHash": "7215e373cdf54b3a88fc434436bb66b62cb05904f02eaf0b51d512308ee9c829",
   "specVersion": "1.1.0"
 }

infra/gitops/clusters/statecraft-hetzner/statecraft/deployment.yaml

@@ -53,14 +53,12 @@ spec:
         - name: statecraft
           # Pinned by digest, never `:latest`. The tag is recorded alongside
           # for human legibility only; the digest is what is deployed.
-          # tag: 676b642 (006-fleet-port-pullsecret merge, 2026-07-23) - the
-          # fleet placement enablers (spec 006 amendment): the deploy-chosen
-          # container port (persisted on fleet_app; its BIGINT ALTER was
-          # applied to the live database before this pin) and the code that
-          # reads the FLEET_IMAGE_PULL_SECRET env set below. The prior
-          # digest (aeefe203, built from dfe27c1) is the spec 012 operator
-          # dashboard adoption.
-          image: ghcr.io/statecrafting/statecraft@sha256:f9fa57c924d8f579c982bf792bc8e9d5575f74e6a351c7a9ffa4288a4cfdeb4f
+          # tag: 5cbbded (006-fleet-native-020 merge, 2026-07-23) - the
+          # @statecrafting/fleet-native 0.2.0 pin (spec 006 amendment): the
+          # per-app ingress-allow NetworkPolicy, ending the namespace-wide
+          # port pin the in-pod two-stage E2E surfaced. The prior digest
+          # (f9fa57c9, built from 676b642) is the fleet placement enablers.
+          image: ghcr.io/statecrafting/statecraft@sha256:43717a271e3936a051c8baccc4893e1f4dbd3319ef376332afcc9eb3960e03d2
           imagePullPolicy: IfNotPresent
           # Fail-loud (spec 009 section 4.2, built 2026-07-23). Encore's
           # $env-bound secrets resolve absent-as-empty and are read lazily, so

specs/009-control-plane-deploy/spec.md

@@ -1283,3 +1283,15 @@ Deployment's env (section 4.4 note). One secret-shaped delta rides the
 manifest rather than the pod Secret: `FLEET_IMAGE_PULL_SECRET` is a
 resource name and travels as plain env. The digest change rolls the pod
 by itself (Recreate); no pod delete is needed.
+
+## Amendment (2026-07-23, fourth pin): fleet-native 0.2.0
+
+The Deployment moves to digest `43717a27` (tag `5cbbded`, the PR #67
+merge). It carries exactly one change: the `@statecrafting/fleet-native`
+pin at 0.2.0, whose per-app ingress-allow NetworkPolicy ends the
+namespace-wide port pin the 2026-07-23 in-pod two-stage E2E surfaced
+(spec 006 amendment, statecrafting spec 006 amendment). No schema delta,
+no new secret, and no env change rides this pin; the digest change rolls
+the pod by itself (Recreate). Post-roll the operator deletes the stale
+hand-patched `fleet-allow-ingress-nginx` from the test tenant namespace,
+per the spec 006 amendment's migration note.