fix(ci): pin the image to the commit SHA instead of the mutable :latest tag

The review flagged `:latest` as a critical issue, and it is right: a mutable
tag makes `kubectl rollout undo` meaningless and lets different pods in the
same deployment run different code if they restart at different times.

- The build job now pushes the image with BOTH `:latest` and
  `:${{ github.sha }}`.
- The deployment manifest carries a sentinel tag rather than `:latest`, and
  the deploy job sets the real SHA with `kubectl set image`. That makes the
  deploy a genuine manifest change, so the Deployment rolls because its pod
  template changed — not because it was told to. `kubectl rollout undo` now
  means something: it goes back to the previous SHA.
- The digest check now compares against the SHA tag rather than `:latest`,
  and it checks EVERY running pod instead of `items[0]`. During a rolling
  update `items[0]` may still be an old pod that has not been terminated,
  which would compare against the wrong digest. The job also fails if the
  deployment is not fully rolled out.
- The smoke test now checks the app through the Service as well as directly
  in the pod. The pod check alone would pass even if the Service selector
  or the port mapping were wrong.
- `readOnlyRootFilesystem: true` — the app writes no files, so the root
  filesystem can be read-only. /tmp is still writable via the emptyDir.
- The kubectl install is skipped when the runner already has one.

kube/beer-deployment.yaml

@@ -22,7 +22,13 @@ spec:
     spec:
       containers:
         - name: beer-data
-          image: git.aridgwayweb.com/armistace/beer-data:latest
+          # The image tag is pinned to the commit SHA by CI (`kubectl set
+          # image`).  The value here is a sentinel: applying the manifest
+          # as-is would leave the deployment on that sentinel, so CI always
+          # replaces it before rolling.  It is deliberately NOT `:latest` —
+          # a mutable tag makes the rollout a no-op (the pod template does not
+          # change) and makes `rollout undo` meaningless.
+          image: git.aridgwayweb.com/armistace/beer-data:SET_BY_CI
           imagePullPolicy: Always
           ports:
             - containerPort: 5000
@@ -56,7 +62,10 @@ spec:
             capabilities:
               drop:
                 - ALL
-            readOnlyRootFilesystem: false
+            # The app reads its own source and talks to Mongo over the
+            # network.  It writes no files, so the root filesystem can be
+            # read-only.  /tmp is still writable via the emptyDir below.
+            readOnlyRootFilesystem: true
           livenessProbe:
             httpGet:
               path: /healthz