Merge pull request 'docs(uptime-monitor): correct two comments in the IMC manifests (REN-6)' (#1007) from atlas/ren-6-imc-comment-corrections into master

Reviewed as argus-bot (review 1056) at head 2821629e. Comment-only, reproduced independently in a private worktree: `git diff -U0` against merge-base 64ee49ab has no added or removed line that is not a whole-line `#` comment, and with comment lines stripped both files are md5-identical to master (crd f753baa9c9684002ad01d309e98755ba, rbac 092ddad9c003209d4bd27721c04048b1). Non-comment bytes identical means the parsed YAML is identical, so the applied objects cannot change: no apply, no RBAC change, no restart of the ingressmonitorcontroller pod.

Provenance re-derived from upstream, not taken from the PR body: 2deeba18 is the v2.2.13 tag commit (2026-05-06), aaffd8a8 is a 2-parent master merge commit (2026-09-25), the two chart CRDs are byte-identical, and the vendored body matches upstream at the tag (md5 f753baa9c9684002ad01d309e98755ba over `apiVersion:` to EOF) — so the new header is a check a human can actually run. All seven cmd/main.go + ingress-wrapper.go + url.go line citations in rbac.yaml verified at the tag.

Render check is CI's ci-manifests-test (green at 2821629e, with ci-scripts-test and pr-review; combined state success) — no kustomize in my sandbox either, so I am not claiming a local render.

Revert: `git revert <this-merge-sha> -m 1`. Nothing in the cluster to unwind.

Closes the two follow-ups recorded on the #995 merge (REN-6).

kubernetes/apps/uptime-monitor/crd-endpointmonitors.yaml

@@ -1,8 +1,17 @@
 # VENDORED, DO NOT EDIT BY HAND.
 #
-# Source: stakater/IngressMonitorController chart 2.2.13,
+# Source: stakater/IngressMonitorController at tag v2.2.13 — the tag the image in
+#   deployment.yaml is pinned to — commit 2deeba188fbd2860d0b3a7c3590a954a1a709924,
 #   charts/ingressmonitorcontroller/crds/endpointmonitor.stakater.com_endpointmonitors.yaml
-# Copied verbatim at commit aaffd8a866aa09a77030979d938e766895bde5d4.
+# Everything below this header is byte-identical to that file: md5
+#   f753baa9c9684002ad01d309e98755ba over `apiVersion:` to EOF. The only edits are
+#   this header and the dropped leading `---`.
+#
+# An earlier revision of this header cited aaffd8a866aa09a77030979d938e766895bde5d4
+# instead. That is a master merge commit dated 2026-09-25, four months after the
+# v2.2.13 tag (2026-05-06). The file content was not affected — the chart CRD is
+# unchanged between the tag and that commit — but a citation pointing at a moving
+# branch cannot be used to check this file against the version actually deployed.
 #
 # Vendored rather than installed via HelmRelease because this Kustomization
 # ships hand-written RBAC (see rbac.yaml) — the chart's own Role grants pods,

kubernetes/apps/uptime-monitor/rbac.yaml

@@ -15,11 +15,21 @@
 #     `tryGetHealthEndpointFromIngress` (pkg/kube/wrappers/ingress-wrapper.go:126),
 #     which is reached only from the `urlFrom.ingressRef` path and only when the
 #     EndpointMonitor sets no explicit `healthEndpoint`. It is a best-effort
-#     guess at a readiness-probe path: both the Get and the List log the error
-#     and return `"", false` on failure, so a denial costs a log line, not a
-#     reconcile. Since the ingressRef path can only reach this namespace anyway
-#     (see the ingresses rule below) and nothing here serves HTTP, the grant
-#     would be inert. Add it if an Ingress ever lands in `uptime-monitor`.
+#     guess at a readiness-probe path. Omitted because that path cannot reach
+#     anything here: ingressRef resolves against the EndpointMonitor's own
+#     namespace (see the ingresses rule below) and nothing in `uptime-monitor`
+#     serves HTTP, so the grant would be inert.
+#     It does NOT fail gracefully, so grant it BEFORE an Ingress lands in this
+#     namespace, not after the first EndpointMonitor points at one. The function's
+#     own error branches do log-and-continue, but an RBAC denial never reaches
+#     them: the reconciler's client is `mgr.GetClient()` (cmd/main.go:168), the
+#     cache-backed client, so the first Service Get starts an informer and waits
+#     for it to sync on a `context.TODO()` that nothing cancels. A forbidden
+#     list/watch means that sync never completes, the Get never returns, and the
+#     single reconcile worker (`--max-concurrent-reconciles`, default 1,
+#     cmd/main.go:84) stops processing anything at all. `/readyz` is
+#     `healthz.Ping` (cmd/main.go:182) and keeps answering, so the pod stays
+#     Ready while reconciliation is wedged.
 #   - `route.openshift.io/routes` — OpenShift only; `kube.IsOpenshift` is false
 #     here, so the Route scheme is never even registered (cmd/main.go init()).
 #   - `endpointmonitors/finalizers` — IMC uses no finalizers. Deletion is driven