Re-cut v0.1.5: the temporal-adapter, the CDC producer, and an SNI lockout

[rahulv8]

Three fixes found after v0.1.5 was tagged. Nobody has installed the published
0.1.5 yet, so the tag gets re-pointed at this commit rather than spending a
0.1.6 on it.

The tree differs from the published 0.1.5 in six files — the three fixes and
nothing else. No frontend or feature work rides along; that waits for 0.1.6.

What changed

The k8s temporal-adapter now waits for Kafka. createKafkaProducer failing is
log.Fatalf with no retry — exactly like the orchestrator's kafka.NewManager —
but only the orchestrator was wired to wait. A fresh kind install of chart 0.1.5
brought the adapter up after 4 restarts, every one Failed to create Kafka producer ... connection refused.

The guard that should have caught this asserted the literal kafka.NewManager was
absent from the other two main.gos — a symbol the adapter never uses, so the test
was green and the property untrue. It now matches a family of Kafka constructors
and checks the policy in both directions: a service that builds a client while
marked exempt fails, and one marked waiting whose constructor vanished fails too.

kafka-connect restarts. It defaulted to RestartPolicy=no, so a single OOM kill
stopped CDC capture permanently while every topic still read lag 0 and the pipeline
still read running — a dead producer and a caught-up one are indistinguishable
from lag alone. Its memory cap goes to 2 GiB, which is what the measurement showed
it actually using; the overrun is native memory held by Debezium's change-stream
cursor, so raising -Xmx would have made it worse.

sniStrict goes back to false (Traefik's own default). true refuses any
handshake whose SNI does not match a configured certificate, which makes
https://<ip>/ unreachable — the only address an operator has before DNS points
anywhere. The TLS floor, the cipher suites, certificate validation and HSTS are
unchanged.

Verification

• The changed chart guard: 18 passed on this tree.
• The full doc-guard list (21/21 files resolved): 170 passed, 18 skipped — every
  skip names a file scripts/flip/excludes.txt deliberately removes.
• Observability vendor census: 4 passed, including test_the_census_is_not_vacuous.
• Push gate git ls-files -i -c --exclude-standard → exactly frontend/next-env.d.ts,
  zero .pyc and zero .pytest_cache.

🤖 Generated with Claude Code