feat(009,012): re-pin the Deployment to the spec 012 operator-dashboard image

.derived/codebase-index/by-spec/009-control-plane-deploy.json

@@ -81,5 +81,5 @@
     "specStatus": "approved"
   },
   "schemaVersion": "1.1.0",
-  "shardHash": "de36b2b91cdecc01aadc858fe6c4b6f9b3351673e1e740c0eb0dec75d9e26066"
+  "shardHash": "9502ec116c9edf7b497e1b1556bf6a75fcdfa143b4b21db86ec968b23d0a1af4"
 }

.derived/spec-registry/by-spec/009-control-plane-deploy.json

@@ -50,13 +50,14 @@
       "5.1 Bring-up outcome, 2026-07-21",
       "6. Human checkpoints",
       "7. Out of scope",
+      "Amendment (2026-07-22): re-pin to the spec 012 image",
       "Amendment (2026-07-22): spec 012 frontend-admin adoption, deploy env"
     ],
     "specPath": "specs/009-control-plane-deploy/spec.md",
     "status": "approved",
     "summary": "Stand the control plane up on the spec 010 cluster as a platform-grade K8s deployment at app.statecraft.ing. Rewritten ground-up 2026-07-19 to the two-plane thesis (001 section 3), which unpauses it. The rewrite inverts the deploy's job: the published image is embedded-rauthy and self-seeds its own identity on first boot, so the shared-rauthy secret set is void, five of the eleven Encore secrets are discarded by the entrypoint if injected, and the /data volume becomes the identity anchor of the platform. What the deploy still owes the container: nine real secrets, the non-secret env, a Postgres URL, an ingress, and one seeder pass for the only thing first boot cannot seed (the upstream GitHub provider, which rauthy has no declarative bootstrap for). Operator surfaces gate on the custom statecraft_operator role, seeded here; rauthy_admin stays break-glass. Live bring-up is a human checkpoint.\n",
     "title": "The control-plane deploy: one governed container on the statecraft cluster"
   },
-  "shardHash": "8825544b805aa6b0ef80ab3eef700714af5fbc7bab60b22919354b8db827c0b8",
+  "shardHash": "b4a0c075332734b13c529d7137363b0483b99b7e1dadebfcb484abd1587ccd01",
   "specVersion": "1.1.0"
 }

infra/gitops/clusters/statecraft-hetzner/statecraft/deployment.yaml

@@ -51,13 +51,14 @@ spec:
         - name: statecraft
           # Pinned by digest, never `:latest`. The tag is recorded alongside
           # for human legibility only; the digest is what is deployed.
-          # tag: 4d0a392 (009-proxy-secfetch, 2026-07-21) - the rauthy proxy
-          # strips Sec-Fetch-* so the GitHub upstream login callback is not
-          # blocked as a forged cors request (spec 002, fifth chassis hunk). The
-          # prior digest (baf41728, built from 2e3c9d7) added SMTP 587/STARTTLS
-          # but still corrupted Sec-Fetch-Mode in the proxy, so upstream login's
-          # return leg 400'd.
-          image: ghcr.io/statecrafting/statecraft@sha256:e4cc8b90f07b6d0ccd7074b1eecef94f1d262250aad240f0cec094b07dd90d9d
+          # tag: dfe27c1 (012-frontend-admin-adoption merge, 2026-07-22) - the
+          # operator dashboard adoption (spec 012): backend/obs/ (/metrics +
+          # the trace plane), backend/admin/ + the frontend-admin bundle gated
+          # on statecraft_operator, app-model.json in the image, and the spec
+          # 011 tenant-lifecycle code's first deploy (its user_account ALTER
+          # was applied to the live database before this pin). The prior
+          # digest (e4cc8b90, built from 4d0a392) is the Sec-Fetch proxy fix.
+          image: ghcr.io/statecrafting/statecraft@sha256:ce8edee50114b655859e8d5b8c9e37fc9c5934de1daa402b47a7a9bf6faa2bca
           imagePullPolicy: IfNotPresent
           ports:
             - name: http

specs/009-control-plane-deploy/spec.md

@@ -1140,6 +1140,18 @@ Live bring-up is operator work, proposed here rather than performed.
   structural, not deferred tuning).
 - Re-homing the marketing site: the apex stays GitHub Pages.
 
+## Amendment (2026-07-22): re-pin to the spec 012 image
+
+The Deployment moves to digest `ce8edee5` (tag `dfe27c1`, the spec 012
+merge): the first image carrying the operator dashboard (spec 012) and
+the spec 011 tenant-lifecycle code. The spec 011 §9 one-time
+`user_account` ALTER (github_user_id + github_login) was applied to the
+live database before this pin (its stamp_job precursor already
+existed), so the new image's auth store boots against a compatible
+schema. `RAUTHY_API_KEY` remains unminted (spec 011's remaining
+deploy-time act); github-identity resolution degrades to a logged
+`no_api_key` skip until it exists, which blocks nothing in this deploy.
+
 ## Amendment (2026-07-22): spec 012 frontend-admin adoption, deploy env
 
 Spec 012 makes one coordinated edit in this spec's deploy manifest