Prove Kubernetes TLS identity rotation and rollback under load

[RicheyWorks]

Outcome

• prove inbound TLS identity rotation and rollback with two independently rooted immutable Kubernetes TLS Secrets
• keep continuous dual-CA traffic running while the Deployment Secret pointer changes in both directions
• require trust-boundary changes, served-leaf fingerprint changes, full pod UID turnover, unchanged image IDs, two-zone readiness, and per-replica/backend traffic
• advance the live topology profile to schema v5 and reject 52 unsafe profiles

Verification

• focused Kubernetes contract tests: 4 passed
• staged shell contract: 52 unsafe profiles rejected
• full Maven test suite: 2,327 passed
• Maven package with tests skipped: passed

The live disposable kind proof is delegated to exact-head Linux CI because Docker Desktop is unavailable locally.