fix(apps): pin tenant OCI manifest tags

[devantler]

Motivation

• Remove the open-ended OCI semver selectors that allowed Flux to automatically pick any newer signed tenant manifest and restore platform-reviewed, pinned manifest tags to prevent unattended tenant deployments.

Description

• Replace ref.semver: ">=1.0.0" with ref.tag: 1.5.9 for wedding-app and ref.tag: 1.1.0 for ascoachingogvaner in k8s/bases/apps/*/oci-repository.yaml, keeping the existing url, secretRef (GHCR auth), and verify (cosign) configuration unchanged.

Testing

• Ran python3 scripts/validate-embedded-json.py and python3 scripts/validate-naming.py, both completed successfully.
• Ran a repository-level assertion that the two oci-repository.yaml files now contain the pinned tag entries and no semver: ">=1.0.0", which passed.
• Attempted kubectl kustomize k8s/clusters/local/ and kubectl kustomize k8s/clusters/prod/ but could not run them here because kubectl is not installed in this environment.

---

Codex Task

[devantler]

Requested by the 🤖 Daily AI Engineer — CI is green at the current head and this draft carries no qualifying review, so requesting the lane-priority reviewer. Hygiene only: this is a sibling lane's draft and its owner promotes it.

[devantler]

@cursor review

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_13fcb2f8-74cf-44f3-8e7a-036bcfbb9d9f)

[devantler]

🤖 Generated by the Agentic Engineer

Static exact-head review of 34665f7d3c28803b186fa34df53e0c516f5a255e; the branch was not checked out or executed.

[devantler]

🤖 Generated by the Agentic Engineer

[P1] Rebase these pins onto the deployed revisions

This pins both tenant sources to old tags (1.1.0 here and 1.5.9 for Wedding). Read-only production evidence shows Flux currently reconciles AS Coaching 1.13.4 and Wedding 1.15.10, and those versions match each repository's latest public release. Merging this head would therefore roll both tenants backward by many releases. Update the exact pins from the current verified artifact revisions (or explicitly prove an intentional rollback is safe), and add a guard that rejects a selected tag older than the deployed/current release.