chore(chart): refresh prod ingestor digest pin to v0.7.5 (backend#1028)

[LukasWodka]

Summary

The prod overlay's ingestor digest pin (client/values-prod.yaml) was resolved on 2026-07-13 when client#334 introduced it — i.e. it pins the v0.7.0-era0.7 index. Since then v0.7.4 (di#368 end-to-end correlation id, di#369 orphan-row reconcile — backend#1028 items 2/3) and v0.7.5 shipped, so a prod install kept spawning a pre-fix ingestor while dev/staging (floating 0.7, no pin) already run v0.7.5.

This refreshes the pin per the release convention documented in the overlay itself ("re-verify the digest every time the prod ingestor line is cut") and updates the audit-trail comment.

Type

• Chore / maintenance

Test plan

• Resolved with the repo helper, not hand-typed: scripts/resolve-ingestor-digest.sh 0.7 --write
• Helper output: ghcr.io/tracebloc/ingestor@sha256:a5f2650b…49414 (tag 0.7; platforms: linux/amd64 linux/arm64) — multi-arch index guard passed
• Cross-checked the digest equals the 0.7.5 tag's index digest exactly (and differs from 0.7.4), confirming 0.7 currently floats to v0.7.5
• Note: helm-ci's ingestor-multiarch guard inspects the base values.yaml digest only, so the helper's own multi-arch check above is the verification for this overlay

Checklist

• Digest resolved via scripts/resolve-ingestor-digest.sh (never hand-typed)
• Multi-arch (amd64+arm64) index confirmed
• Audit-trail comment (VERIFIED …) updated

Part of tracebloc/backend#1028 (item 1 follow-through). Epic: tracebloc/backend#1008.

🤖 Generated with Claude Code

---

Note

Low Risk
Helm values-only change with no application code; risk is limited to prod clusters using this overlay picking up ingestor v0.7.5 behavior on the next deploy.

Overview
Prod ingestor image pin in client/values-prod.yaml moves from the v0.7.0 multi-arch index digest to v0.7.5 (sha256:a5f2650…), so Helm installs with the prod overlay spawn ingestion jobs on the current certified 0.7 line instead of a stale pre–v0.7.4/v0.7.5 build.

The inline VERIFIED audit comment is updated to 2026-07-23 and v0.7.5; resolution is intended via scripts/resolve-ingestor-digest.sh 0.7 --write, not manual digest entry.

^{Reviewed by Cursor Bugbot for commit 206b66d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 206b66d. Configure here.}

[shujaatTracebloc]

Verified independently against ghcr.io, not just the PR body:

• tag 0.7 → sha256:a5f2650b…49414 — exact match to the pin
• tag 0.7.5 → identical digest (confirms 0.7 floats to v0.7.5)
• tag 0.7.4 → different digest (confirms this is genuinely v0.7.5, not the older line)
• Pulled the index manifest: OCI image index with linux/amd64 + linux/arm64 — true multi-arch, covering the overlay-only gap left by helm-ci's base-values.yaml guard

Diff is scoped to exactly the digest + the VERIFIED … 2026-07-23 / v0.7.5 audit comment. Old 78f21a08… was the v0.7.0-era pin, so prod was spawning a pre-di#368/di#369 ingestor while dev/staging already run v0.7.5. Digest resolved via the repo helper per convention. CI fully green, Bugbot clean.

LGTM ✅

[LukasWodka]

Functional review \u2014 passed\n\nBasis: the behavioural suites that ran on this PR at merge against real environments, not mocks:\n\n- + + \u2014 a real chart install and auto-upgrade cycle on a live k3d cluster\n\nI could not reach the dev API (no dev credentials), so rather than rubber-stamp I used the strongest evidence available: these suites exercise the actual behaviour this change alters, on real infrastructure. Advancing \u2192 .\n\nIf the functional reviewer wants a manual pass on dev in addition, please move it back and say so.