Prove Kubernetes image rollout and rollback under load

[RicheyWorks]

Outcome

• replace the disposable kind lane's same-image restart with a content-distinct metadata-only candidate rollout
• roll the deployment back to the exact baseline image under a second continuous TLS/API-key traffic window
• require complete pod UID turnover, two ready endpoints, runtime image-ID transition/restoration, two-zone placement, and traffic on both replicas/backends after each transition
• reuse the already-scanned CI candidate image and keep the evidence boundary explicit: local mechanics, not application-layer release compatibility or registry proof

Verification

• bash scripts/bench/kubernetes-topology-contract-test.sh from an LF-normalized checkout: 36 unsafe profiles rejected
• mvn -B -Dtest=KubernetesLiveTopologyContractTest test
• mvn -B test: 2,327 tests, 0 failures/errors/skips
• mvn -B -DskipTests package
• git diff --check

The local Docker engine was unavailable, so the required live kind execution is intentionally delegated to the exact-head Linux CI topology gate.