docs: refresh stale BUGBOT.md guidance (curl_secure + prodDigest) — Bugbot #383

[shujaatTracebloc]

Resolves two Cursor Bugbot findings on the client promotion PR (#383, develop → main) — both stale reviewer guidance in .cursor/BUGBOT.md.

Fixes:

• Stale curl TLS guidance (Medium) — the "Always flag" bullet still described CURL_SECURE="--tlsv1.2" as a constant every call site splices by hand and listed "already missing" TLS sites. The real current rule is the curl_secure() wrapper in scripts/lib/common.sh (bakes in the TLS floor + timeouts), enforced by scripts/check-style.sh rule 3 ("no bare curl"). Rewrote the bullet to flag a bare curl that bypasses curl_secure(), and listed the real exemptions (install.sh / the WSL here-string that can't source common.sh, comments, presence tests, the user-facing curl … | sh one-liner). (Release develop → main #383 (comment))
• Stale prod overlay pin guidance (Medium) — the "Image pinning drift" bullet told reviewers CI ignores client/values-prod.yaml and to flag prod-overlay digest edits. That overlay was deleted; the fleet-wide prod pin moved to the chart default images.ingestor.prodDigest in client/values.yaml, and the ingestor-multiarch guard in .github/workflows/helm-ci.yaml reads it and hard-fails if it's empty or not multi-arch (also checks images.ingestor.tag and per-edge images.ingestor.digest). Rewrote to the real contract. (Release develop → main #383 (comment))

Verified against the current common.shcurl_secure(), check-style.sh rule 3, the deleted values-prod.yaml, client/values.yamlimages.ingestor.prodDigest, and the ingestor-multiarch job before rewriting. Docs-only.

Lands on develop; the promotion PR head picks these up on the next develop sync and Bugbot re-reviews.

🤖 Generated with Claude Code

---

Note

Low Risk
Documentation-only change to Bugbot guidance; no runtime, CI logic, or chart behavior is modified.

Overview
Docs-only refresh of Cursor Bugbot reviewer rules in .cursor/BUGBOT.md so automated review matches how the installer and chart actually work today.

The TLS / curl “Always flag” bullet no longer describes CURL_SECURE as something every call site must splice by hand or lists stale “missing TLS” file paths. It now tells reviewers to flag bare curl that bypasses curl_secure() in scripts/lib/common.sh, notes CI enforcement via check-style.sh rule 3, and documents the real exemptions (install.sh, WSL here-string, comments, presence checks, user-facing curl | sh one-liner).

The image pinning drift bullet no longer references client/values-prod.yaml or “CI ignores the prod overlay.” It documents the fleet-wide prod pin as chart default images.ingestor.prodDigest in client/values.yaml (overlay removed per backend#1245) and the ingestor-multiarch job in .github/workflows/helm-ci.yaml — including hard-fail on empty prodDigest and checks on tag, prodDigest, and per-edge digest.

^{Reviewed by Cursor Bugbot for commit 0fc092a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[shujaatTracebloc]

Folded into #406 (branch fix/bugbot-ps-guard-probe-kubever) — per the directive to clear all client promotion-PR #383 findings with a single fix PR. The BUGBOT.md curl_secure + prodDigest doc fixes now ride on #406 (commit 83dc2f4). Closing this to avoid a second open client PR.