feat(client): harden image pinning and credentials (v1.0.4)

[saadqbal]

Summary

Address the High-severity findings from the client chart security review.

• Digest pinning — tracebloc.image helper now supports an optional digest field. New images.jobsManager.digest, images.podsMonitor.digest, images.mysqlClient.digest, and images.busybox.digest values render repo@sha256:... and drop imagePullPolicy to IfNotPresent for immutable, auditable rollouts.
• Remove mysql-client:latest — now uses images.mysqlClient.tag (default "prod"). The schema rejects "latest"; operators wanting absolute pinning should set images.mysqlClient.digest.
• Harden bare-metal mysql init-container — still runs as root (kubelet does not apply fsGroup to hostPath volumes, k8s#138411), but now with drop: [ALL] + add: [CHOWN], allowPrivilegeEscalation: false, readOnlyRootFilesystem: true, and seccompProfile: RuntimeDefault.
• Remove deceptive credential placeholders — clientId / clientPassword defaults are now empty strings. Both the schema and secrets.yaml reject empty values and <...>-style placeholders so deployments fail fast instead of silently base64-encoding a placeholder into the Secret.

Chart bumped 1.0.3 → 1.0.4.

Test plan

• helm lint client passes (CSI and bare-metal value sets)
• helm unittest client — all 76 tests pass, plus new coverage for placeholder and empty-credential rejection
• helm template renders correct digest form when images.*.digest is set
• helm template with clientId: "<CLIENT_ID>" fails schema validation
• Smoke install on a CSI cluster (EKS/AKS) with and without images.mysqlClient.digest
• Smoke install on bare-metal with hostPath.enabled=true to confirm the hardened init-container still succeeds

---

Note

Medium Risk
Medium risk because it changes rendered image references/pull policies and makes clientId/clientPassword validation fail-fast, which can break existing installs that relied on placeholders or implicit pulls.

Overview
Bumps the chart/app version to 1.0.4 and adds an images.* values block to support optional digest-pinned images via tracebloc.image (rendering repo@sha256:... when provided) and adjusts imagePullPolicy accordingly.

Removes mutable image usage by switching MySQL and init-container images to configurable tags/digests (rejecting latest for mysql-client/busybox) and tightens the bare-metal MySQL initContainer security context (minimal capabilities, no escalation, read-only rootfs, default seccomp).

Makes credentials mandatory and non-placeholder: defaults for clientId/clientPassword become empty, secrets.yaml fails on empty or <...> values, schema validation is updated to enforce this, and Helm unit tests are updated/added to cover the new failure cases.

^{Reviewed by Cursor Bugbot for commit eac812a. Bugbot is set up for automated code reviews on this repo. Configure here.}