Sync main → develop after v1.4.4 release

[saadqbal]

Back-merges the v1.4.4 release sync commit (#188) from main into develop so the branches don't diverge. Zero file diff — history-only resync, mirrors #182. See #184.

---

Note

Low Risk
Empty diff and history-only merge; no runtime, security, or deployment impact from this PR itself.

Overview
No code or config changes — the PR diff is empty. This is a branch resync: develop is updated to include the release sync commit from main (v1.4.4, same pattern as prior back-merges like #182).

There is nothing new for reviewers to validate in the tree; the goal is to keep main and develop aligned in git history so future work on develop does not diverge from what shipped on main.

^{Reviewed by Cursor Bugbot for commit c719326. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 20 / 8

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#98 — ci: add fr-gate caller workflow · author: @LukasWodka · no reviewer assigned
• client#180 — fix(resource-monitor): always grant read-only ClusterRole (decouple from clusterScope) · author: @shujaatTracebloc · reviewer: @saadqbal
• client#183 — fix(rbac): grant get on configmaps/secrets to jobs-manager SA · author: @shujaatTracebloc · reviewer: @saadqbal
• client#187 — fix(chart): pin a multi-arch ingestor digest — arm64 ingestion was broken (closes Ingestor pinned to an amd64-only digest — arm64 data ingestion fails (ImagePullBackOff) #186) · author: @LukasWodka · no reviewer assigned
• client-runtime#61 — docs: record MySQL credential threat-model decision · author: @saadqbal · no reviewer assigned
• client-runtime#67 — ci: publish jobs-manager images on merge (closes the deploy-delivery gap) · author: @LukasWodka · no reviewer assigned
• client-runtime#68 — fix(pods-monitor): watch the release namespace, not hardcoded "default" · author: @shujaatTracebloc · no reviewer assigned
• client-runtime#70 — fix(Helm chart auto-update — deployed clients stay frozen on installed version #69): don't evict SB sender on payload serialize fail; drop redundant COPY · author: @saadqbal · no reviewer assigned
• client-runtime#71 — test(submit): lock ingestor pod securityContext (regression guard for NetworkPolicy locking down training-pod egress #42/Add consolidated docs/SECURITY.md #44) · author: @LukasWodka · no reviewer assigned
• data-ingestors#145 — docs(releasing): reframe step 7 as optional greenfield-baseline bump · author: @saadqbal · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)