Absorbs the durable long-term pieces from the superseded incident recovery
(#10278) into the hardened RollingUpdate contract — no Argo/Flagger/mesh/Gateway.

Exact-digest build-once promotion contract (incident-class artifact fix):
- chart renders repository@sha256:<hex> when image.digest is set; rejects
  malformed/ambiguous identity, and a digest + mutable tag, at render time
- rollout gate admits a digest only with tag dropped and pullPolicy IfNotPresent
  (the digest is the content address; Always only adds a registry round-trip);
  tag mode (chart delegates the tag to the deploy workflow) is unchanged
- rollback contract restore is digest-aware; stale SCA-40 ownership notes removed

Cross-resource shared-config migration guard (2026-07-22 incident root fix):
- new verify_shared_config_migration.py fails CLOSED before any mutation when a
  serving workload still references a ConfigMap/Secret source or key the proposed
  state removes or reclassifies — the exact partial transition that dropped prod
  Pusher to zero healthy pods while /health stayed green
- reads object/key NAMES only; never reads, prints, or stores values
- transition-aware: a key moving between objects is allowed only once no stale
  old-source reference remains

Discards the incident-only chart-only recovery CLI surface and its broad
normalize() (which could hide real chart policy drift), per SCA-39 objective.

Coverage: 4 new gate digest tests + 9 migration-guard fixtures incl. the
historical partial transition and fail-closed drift. End-to-end verified against
the real rendered dev Pusher chart (22 refs resolve; a depleted REDIS_DB_HOST
inventory is caught).

…ce digest pullPolicy

Independent review (reviewer + adversarial refuter) converged on one MAJOR finding: the shared-config migration guard scanned only explicit env.valueFrom refs and was blind to envFrom whole-object bulk loads. Pusher bulk-loads ALL ConfigMap keys via envFrom, so a key removed from that ConfigMap (the exact 2026-07-22 outage class) went undetected when it lacked an explicit ref.

- verify_shared_config_migration.py now scans envFrom sources: a bulk-loaded object must still exist, and (given a previous inventory) no key may be removed from it.
- Generalizes to every pod-template workload (Deployment/StatefulSet/DaemonSet/Job/CronJob/ReplicaSet) and scans initContainers.
- Chart render-enforces image.pullPolicy=IfNotPresent for a digest-pinned release (defense-in-depth matching the gate).

Coverage: +4 migration-guard tests (envFrom object/key removal, envFrom clean pass, StatefulSet+initContainer). 81 affected tests pass; real rendered dev Pusher now reports 22 per-key refs + 1 envFrom source.

…I, fix rollback capture/restore

Address three Codex review threads (all P2):

1. backend/routers/pusher.py — Move websocket.accept() BEFORE the drain check.
   A pre-accept close is surfaced as a failed HTTP upgrade by the websockets
   client, which backend-listen records as a circuit-breaker failure
   (backend/utils/pusher.py:153-159). During a normal rollout, enough
   straggler connections can trip the pod's pusher circuit even though other
   pusher pods are healthy. Accepting first ensures the client sees a clean
   1001 Going Away close frame instead.

2. .github/checks-manifest.yaml — Register verify_pusher_rollout_gate.py as
   'pusher-rollout-quality-gate' so it actually runs in the pre-push/CI lane.
   Its docstring claimed to run in the shared pre-push lane but it was never
   invoked from the check manifest, leaving the fail-closed
   telemetry/probe/capacity checks as an on-demand-only script.

3. backend/scripts/verify_pusher_rollout_gate.py — Fix the rollback contract
   capture/restore mismatch. capture_command returned the full image ref
   (gcr.io/.../pusher:tag), but restore_command substituted it into
   --set image.tag=<prior-tag>, which would produce an invalid image like
   gcr.io/.../pusher:gcr.io/.../pusher:tag. Now capture extracts only the
   tag (sed) or digest (grep -oE), and restore uses --set-string to match
   the deploy workflows' Helm convention.

Verification:
- python3 backend/scripts/verify_pusher_rollout_gate.py preflight → OK
- python3 backend/scripts/verify_pusher_rollout_gate.py rollback --env prod → valid JSON
- ENCRYPTION_SECRET=*** .venv/bin/python -m pytest tests/unit/test_verify_pusher_rollout_gate.py tests/unit/test_pusher_readiness_drain.py → 18 passed

Address Codex P2 thread #3634765197: the guard's docstring claimed it
ran in the pre-push lane but was never registered in the checks manifest.

- Add self-contained 'preflight' mode (default) that scans pusher chart
  env/envFrom references directly — same pattern as verify_pusher_rollout_gate.
- Register as 'shared-config-migration-preflight' in .github/checks-manifest.yaml
  with local+ci lanes.
- Update existing guard-mode tests to pass explicit 'guard' mode argument.
- Add 5 new regression tests covering preflight pass/default/detect/guard-require
  and explicit guard-mode compatibility.