fix(#459): isolate e2e path 2 from path 1's --reuse-values replay contamination

[shujaatTracebloc]

#459 — chart-default pin updates never reach an edge once hand-upgraded with --reuse-values

helm upgrade --reuse-values records the previous release's computed values (chart defaults + overrides, materialized) as the new release's user-supplied values. From then on, every --reset-then-reuse-values upgrade — exactly what the fleet auto-upgrade CronJob runs — replays those frozen defaults as if an operator set them, winning over the new chart's defaults. So an edge ever hand-upgraded with --reuse-valuessilently stops receiving chart-default updates — most importantly images.ingestor.prodDigest.

Where it bit: the e2e tripwire

e2e-auto-upgrade.sh modelled this on one release: path 1 (--reuse-values) contaminated the recorded values, then path 2 (the fleet auto-upgrade) ran on that same contaminated release. Path 2's pin assertion passed only because the baseline pin and the working-tree pin coincided — the ERA NOTE tripwire the issue documents: the first prodDigest bump would trip it.

Fix (issue decision 1 — isolate path 2 from path 1)

Between the paths, reset the recorded values to just the genuine install-time overrides:

helm upgrade "$NS" "$CHART_DIR" --reset-values \
--set clientId=… --set clientPassword=… --set storageClass.provisioner=…

so paths 2–4 assert clean-edge auto-upgrade behavior — the fleet's real contract on an edge no one hand-upgraded. The working-tree pin now lands on path 2 regardless of the baseline era; no false trip on a future bump.

Added an assertion using the issue's own contamination fingerprint — helm get valueswithout--all must not carry the chart-default prodDigest key after the reset — and rewrote the ERA NOTE to document the resolution.

A contaminated real edge (one an operator hand-upgraded with --reuse-values) stays a separate fleet-audit concern; its remediation is exactly this reset (--reset-values + re-apply intended overrides), noted in-code.

Acceptance criteria

• ✅ Path 2 asserts clean-edge behavior only; the fix(installer): pin k3d + helm versions in install-k8s.ps1 — drop api.github.com latest lookups #410-class contamination no longer bleeds path 1 → path 2.
• ✅ The next images.ingestor.prodDigest bump flows onto the installed edge on path 2 instead of tripping the tripwire.

Gates

• shellcheck --severity=error, check-style, bash -n clean.
• Note: e2e-auto-upgrade.sh runs in the label-gated e2e job (real k3d cluster + published chart), so it isn't exercised by default PR CI — the change is shellcheck-clean and follows the script's existing idioms/assert-from-live-cluster pattern.

Closes#459

---

Note

Low Risk
Test-only change to e2e-auto-upgrade.sh; no production Helm or chart behavior is modified.

Overview
The fleet auto-upgrade e2e gate used one Helm release for both manual --reuse-values (path 1) and fleet --reset-then-reuse-values (path 2), so path 1’s contamination of recorded values could make path 2’s prod pin assertion pass only when baseline and working-tree pins matched.

Between path 1 and path 2, the script now runs helm upgrade against the published baseline chart ($PREV) with --reset-values plus the three real install overrides (clientId, clientPassword, storageClass.provisioner), so new chart defaults are not pre-applied from the local tree. It fails if images.ingestor.prodDigest still appears in user-supplied values (helm get values without --all). Paths 2–4 then exercise clean-edge auto-upgrade behavior; comments replace the old ERA NOTE tripwire with #459 resolution notes.

^{Reviewed by Cursor Bugbot for commit 5b6ee21. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 301c1f8. Configure here.}

[LukasWodka]

/fr-pass