Sync develop → main for v1.4.4 chart release

[saadqbal]

Promotes `develop` to `main` for the v1.4.4 chart release.

The only change ahead of `main` is #185 — the greenfield ingestor baseline bump to v0.3.2 (images.ingestor.digest → sha256:d361fa77…, chart 1.4.3 → 1.4.4). See #184.

What this releases

• Greenfield helm install tracebloc/client / tracebloc/ingestor now land on ingestor v0.3.2 (data-ingestors release: MLM tokenizer fix + relaxed PascalVOC difficult + reserved-id guard, first multi-arch image).
• Existing clusters are unaffected — image-refresh already rolled them to v0.3.2.

Release steps after merge

1. Publish GitHub Release v1.4.4 on main → triggers release-helm-chart.yaml (packages + publishes both charts to gh-pages).
2. Back-merge main → develop.
3. Close Pin greenfield ingestor baseline to v0.3.2 in client chart #184.

---

Note

Low Risk
Chart-only default digest and version bump for greenfield installs; no runtime logic changes and existing rollouts are unchanged.

Overview
Release v1.4.4 promotes the develop→main sync so the published Helm chart matches the ingestor baseline already rolled out via image-refresh.

The chart version / appVersion move from 1.4.3 to 1.4.4. images.ingestor.digest is updated to the v0.3.2 SHA (sha256:d361fa77…), replacing the v0.3.1 pin, with comments refreshed to note data-ingestors fixes (MLM tokenizer, PascalVOC difficult, reserved-id guard) and the first multi-arch ingestor image. The floating tag: "0.3" is unchanged.

Greenfield helm install / upgrades that re-sync the pinned digest will seed INGESTOR_IMAGE_DIGEST to v0.3.2; existing clusters are expected to already be on that digest from image-refresh unless they opted out of auto-refresh.

^{Reviewed by Cursor Bugbot for commit b652b50. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 20 / 8

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#98 — ci: add fr-gate caller workflow · author: @LukasWodka · no reviewer assigned
• client#180 — fix(resource-monitor): always grant read-only ClusterRole (decouple from clusterScope) · author: @shujaatTracebloc · reviewer: @saadqbal
• client#183 — fix(rbac): grant get on configmaps/secrets to jobs-manager SA · author: @shujaatTracebloc · reviewer: @saadqbal
• client#187 — fix(chart): pin a multi-arch ingestor digest — arm64 ingestion was broken (closes Ingestor pinned to an amd64-only digest — arm64 data ingestion fails (ImagePullBackOff) #186) · author: @LukasWodka · reviewer: @saadqbal
• client-runtime#61 — docs: record MySQL credential threat-model decision · author: @saadqbal · no reviewer assigned
• client-runtime#67 — ci: publish jobs-manager images on merge (closes the deploy-delivery gap) · author: @LukasWodka · no reviewer assigned
• client-runtime#68 — fix(pods-monitor): watch the release namespace, not hardcoded "default" · author: @shujaatTracebloc · no reviewer assigned
• client-runtime#70 — fix(Helm chart auto-update — deployed clients stay frozen on installed version #69): don't evict SB sender on payload serialize fail; drop redundant COPY · author: @saadqbal · no reviewer assigned
• client-runtime#71 — test(submit): lock ingestor pod securityContext (regression guard for NetworkPolicy locking down training-pod egress #42/Add consolidated docs/SECURITY.md #44) · author: @LukasWodka · no reviewer assigned
• design-system#19 — fix: un-track coverage/ and node_modules/ from git · author: @LukasWodka · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)