v1.19.2

One fix anyone can see, one nobody could until they tried to install the chart
on the cluster it names.

🐛 Fixes

The about note's dismiss button is a disc on a phone too. It was a 30×44
oval with the cross pushed almost against its left edge. Two rules were
fighting: the one that gives the button a thumb-sized 2.75rem height on a
narrow screen predates the disc, and the disc's own max-width: 1.9rem was
still capping the width from the wider layout. The padding, written for the
smaller disc, then put the glyph 3px from the clip.

The disc is one custom property now, --x-disc, and the height, the width and
the padding are all read from it: calc((var(--x-disc) - var(--x-glyph)) / 2 - 1px)
centres the cross at whatever size the disc is. On a wide screen that resolves
to exactly the calc(.55rem - 1px) that was there, so nothing moved.
Two browser checks now measure the button at 390px and at 320px.

The chart says Kubernetes 1.19 again. kubeVersion is the floor the
templates need, networking.k8s.io/v1 Ingress, and 1.19.1 swept it to
">=1.19.1-0" along with every other string in the repository that read
1.19.1. Unlike version and appVersion, which the release workflow stamps
from the tag, this one goes out exactly as it is written, so the published
chart carried it.

Nothing was refused in practice: it excluded a cluster on 1.19.0 and no more.
Left alone it climbs one release at a time, and the day cairn reaches 1.30 the
chart would decline a 1.29 cluster that runs it perfectly well. It is pinned
now, in just chart and in the CI job, and the failure says which of the two
versions the line is about.

🧹 Internal

The comments were swept, 2151 lines to 1716 across 38 files. The rule: say
the constraint, never restate the code, and turn what you can into code
instead. Where that was possible it produced named things rather than numbers
and glosses: --x-disc, --ring, --z-header, NEAR_TOP, JITTER,
monitorable(), hasMonitor(), coversEveryLocale(), hasDotSegment().
No behaviour moved, and this release was compared against v1.19.1 response by
response to say so rather than assume it.

The chart signing retries. ghcr took the 1.19.1 chart and then timed out
uploading the signature's own blob, three minutes in, which is cosign's
default deadline. The chart went out installable and unsigned until the job
was re-run by hand. The step now allows five minutes and attempts three times,
with cosign verify as the arbiter rather than cosign's exit code: an upload
that landed and lost its answer looks like a failure and is not one.

just demo-rebuild removes orphans. The Apache container that left the
demo in 1.19.1 was still running two days later.

📦 Image

docker pull morgankryze/cairn:1.19.2   # or: ghcr.io/morgankryze/cairn:1.19.2

This release also moves 1.19, 1, stable and latest, on both registries.
Docker Hub gets the digest ghcr signed, copied rather than rebuilt, so the two
are the same object and cosign verify works on either. The chart is at
oci://ghcr.io/morgankryze/charts/cairn version 1.19.2, signed the same way:

cosign verify morgankryze/cairn:1.19.2 \
  --certificate-identity-regexp '^https://github.com/MorganKryze/cairn/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com