test(kuma-sync): remove smoke-test KumaMonitor

Last smoke-test step: Flux prunes the KumaMonitor and the controller's
finalizer deletes Kuma monitor 9.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.woodpecker/alert-monitor.yml

@@ -101,7 +101,7 @@ steps:
         bash scripts/ci/make-diag-kubeconfig.sh
 
   - name: alert-triage-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
     environment:
       CLAUDE_CODE_OAUTH_TOKEN:
         from_secret: claude_code_oauth_token

.woodpecker/ci-scripts-test.yml

@@ -35,25 +35,25 @@ when:
 steps:
   - name: model-selection-tests
     depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
     commands:
       - sh scripts/ci/test-model-selection.sh
 
   - name: pr-review-mistral-tests
     depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
     commands:
       - sh scripts/ci/test-pr-review-mistral.sh
 
   - name: promtool-rules-guard-tests
     depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
     commands:
       - sh scripts/ci/test-promtool-rules.sh
 
   - name: yaml-citations-guard-tests
     depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
     commands:
       - sh scripts/ci/test-yaml-citations.sh
 

.woodpecker/e2e.yml

@@ -26,7 +26,7 @@ steps:
     # fetch-models.sh response mapping. No cluster, no secrets, no network — the
     # ci-claude image just provides sh + jq. Keeps the flag-injection regression
     # test from rotting (it exercises the exact injection shapes).
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
     commands:
       - sh scripts/ci/test-model-selection.sh
 

.woodpecker/issue-fix.yml

@@ -62,7 +62,7 @@ steps:
       - bash scripts/ci/make-diag-kubeconfig.sh
 
   - name: issue-fix-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
     environment:
       CLAUDE_CODE_OAUTH_TOKEN:
         from_secret: claude_code_oauth_token

.woodpecker/security-scan.yml

@@ -18,12 +18,12 @@ when:
 
 steps:
   - name: iac-scan
-    image: aquasec/trivy:latest@sha256:af6acf9a6b85dfe389a1941505c0ce9efef52a4719635e1a962f022a3d855daa
+    image: aquasec/trivy:latest@sha256:2416d1f74045b57274df1a340eee6b510cacd73c66a6ccb8da092b117eb7d222
     commands:
       - trivy fs --format json -o trivy-iac.json --severity CRITICAL,HIGH --ignore-unfixed .
 
   - name: image-scans
-    image: aquasec/trivy:latest@sha256:af6acf9a6b85dfe389a1941505c0ce9efef52a4719635e1a962f022a3d855daa
+    image: aquasec/trivy:latest@sha256:2416d1f74045b57274df1a340eee6b510cacd73c66a6ccb8da092b117eb7d222
     commands:
       - trivy image --download-db-only
       - |
@@ -70,7 +70,7 @@ steps:
     # this step is skipped — otherwise we'd fork-bomb PRs.
     when:
       - branch: master
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
     environment:
       CLAUDE_CODE_OAUTH_TOKEN:
         from_secret: claude_code_oauth_token

.woodpecker/update-audit.yml

@@ -30,7 +30,7 @@ when:
 
 steps:
   - name: update-audit-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.302
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.303
     environment:
       CLAUDE_CODE_OAUTH_TOKEN:
         from_secret: claude_code_oauth_token

ci/images/authentik-gate-sync/Containerfile

@@ -5,12 +5,12 @@
 
 # The unit tests gate the image: the final stage copies the controller out of
 # this stage, so a failing test fails the build.
-FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170 AS test
+FROM python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce AS test
 WORKDIR /src
 COPY controller.py test_controller.py ./
 RUN python3 -B -m unittest -v
 
-FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170
+FROM python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce
 
 RUN useradd --system --no-create-home --shell /usr/sbin/nologin controller
 COPY --from=test /src/controller.py /opt/controller.py

ci/images/claude/Containerfile

@@ -1,4 +1,4 @@
-FROM node:24-alpine@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1
+FROM node:24-alpine@sha256:44fce696f38ba8c987c4db89954051000bbd05ffd8d8659ba15ed4a8602e937f
 
 # Default to the latest Claude Code. Pinning a fixed version is the wrong
 # default here: old releases eventually stop working against the API, so a

ci/images/heating-can/Containerfile

@@ -23,7 +23,7 @@
 # namespace, so can0 is only reachable with network_mode: host. That is also
 # how the local MQTT broker on 127.0.0.1:1883 is reached. CAN_RAW sockets need
 # no capabilities, so both run unprivileged.
-FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170 AS build
+FROM python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce AS build
 
 # Pins live here, in the artifact, rather than in Ansible variables.
 #
@@ -56,7 +56,7 @@ RUN git clone --quiet https://github.com/MyHomeMyData/E3onCAN.git /opt/e3oncan \
  && rm -rf /opt/e3oncan/.git
 
 
-FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170
+FROM python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce
 
 ARG OPEN3E_REF=6553c10453a6bae1210908f38a5af2481a46a3e5
 ARG E3ONCAN_REF=461dcbdf97e8d72d2edb9929c63b39382af6c3a1

ci/images/netbird-service-sync/Containerfile

@@ -2,7 +2,7 @@
 # domains -> TLS passthrough -> Traefik ClusterIP) from Ingresses carrying the
 # public label. Standard library only, so the image is the interpreter plus one
 # file; runs unprivileged as its own user.
-FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170
+FROM python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce
 
 RUN useradd --system --no-create-home --shell /usr/sbin/nologin controller
 COPY controller.py /opt/controller.py

kubernetes/apps/authentik/gate-sync.yaml

@@ -114,7 +114,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: controller
-          image: gitea.renner.uno/gitea_admin/authentik-gate-sync:2026-10-15-0857 # {"$imagepolicy": "flux-system:authentik-gate-sync"}
+          image: gitea.renner.uno/gitea_admin/authentik-gate-sync:2026-10-19-0544 # {"$imagepolicy": "flux-system:authentik-gate-sync"}
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true

kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml

@@ -61,7 +61,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: shelly-manager
-          image: gitea.renner.uno/k.renner/shelly-manager:build.1791777553 # {"$imagepolicy": "flux-system:shelly-manager"}
+          image: gitea.renner.uno/k.renner/shelly-manager:build.1792387459 # {"$imagepolicy": "flux-system:shelly-manager"}
           imagePullPolicy: IfNotPresent
           ports:
             - name: http

kubernetes/apps/home-assistant/deployment.yaml

@@ -159,7 +159,7 @@ spec:
         # substitution to POD_IP so nginx-runtime variables like $host
         # / $http_x_forwarded_for in the template stay intact.
         - name: proxy
-          image: nginxinc/nginx-unprivileged:1.31-alpine@sha256:b9241c6e7b8e9a862f129d8d4199ab64b10390949a78bdd5603379b32c844083
+          image: nginxinc/nginx-unprivileged:1.31-alpine@sha256:378d0c32f6562f7fd9629170797f57d2b953aa09be983b3daaf4809bb039ca00
           env:
             - name: POD_IP
               valueFrom:
@@ -203,7 +203,7 @@ spec:
         # readiness probe on purpose: a broker outage must not take HA out of
         # its Service endpoints.
         - name: mqtt-tls
-          image: ghostunnel/ghostunnel:v1.11.3@sha256:2599b8a04bae16d70a4209495618dea61b46a00a9a05fcf74da282688ad3517f
+          image: ghostunnel/ghostunnel:v1.11.4@sha256:e5248233863aadd36383a11c92360f2981141881ef05e38360a6ada8630d36b1
           args:
             - client
             - --listen=127.0.0.1:11883
@@ -304,7 +304,7 @@ spec:
         # dedicated long-lived token.
         # Runs as root to match HA's root-owned /config files. See config-sync.sh.
         - name: config-sync
-          image: alpine/git:2.54.0@sha256:ce84fd6a057b4dc5cf5009da2dd832f1c6d096c1984bf50496cf3c256402264d
+          image: alpine/git:2.54.0@sha256:03228d7ded483b0b3e55e1de7fa660d70d3e1bb432fa7021d29e192640de11aa
           command: ["/bin/sh", "/scripts/sync.sh"]
           env:
             - name: SYNC_BRANCH

kubernetes/apps/review-bot/deployment.yaml

@@ -32,7 +32,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: review-bot
-          image: gitea.renner.uno/gitea_admin/review-bot:2026-10-18-0706 # {"$imagepolicy": "flux-system:review-bot"}
+          image: gitea.renner.uno/gitea_admin/review-bot:2026-10-19-0540 # {"$imagepolicy": "flux-system:review-bot"}
           env:
             - name: REPOS
               value: k.renner/homelab,konairius/homeassistant,konairius/authentik-samba-bridge,konairius/shelly-manager

kubernetes/infrastructure/image-automation/gitea-mcp.yaml

@@ -4,7 +4,7 @@ metadata:
   name: gitea-mcp
   namespace: flux-system
 spec:
-  image: docker.gitea.com/gitea-mcp-server
+  image: docker.gitea.com/gitea-mcp-server@sha256:20701c3dcf3b71df384417d04f9f6382205b7f362380b258fb8e4dcf9599091f
   interval: 1h
 ---
 apiVersion: image.toolkit.fluxcd.io/v1

kubernetes/infrastructure/openbao/helmrelease.yaml

@@ -24,7 +24,7 @@ spec:
       # window. The StatefulSet rolls one pod at a time (updateStrategyType
       # below). Undo after a pod has run the new server = restore the
       # snapshot, not a git revert.
-      version: ">=0.30.3 <0.31.0"
+      version: ">=0.30.4 <0.31.0"
       sourceRef:
         kind: HelmRepository
         name: openbao

kubernetes/infrastructure/velero/backup-verify-cronjob.yaml

@@ -32,7 +32,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: backup-verify
-              image: gitea.renner.uno/gitea_admin/ci-backup-verify:2026-10-15 # {"$imagepolicy": "flux-system:backup-verify"}
+              image: gitea.renner.uno/gitea_admin/ci-backup-verify:2026-10-19 # {"$imagepolicy": "flux-system:backup-verify"}
               command: ["bash", "/script/backup-verify.sh"]
               env:
                 - name: HOME

kubernetes/restore-test/egress-check.yaml

@@ -11,7 +11,7 @@ spec:
   restartPolicy: Never
   containers:
     - name: check
-      image: docker.io/nicolaka/netshoot:v0.13
+      image: docker.io/nicolaka/netshoot:v0.13@sha256:a20c2531bf35436ed3766cd6cfe89d352b050ccc4d7005ce6400adf97503da1b
       command:
         - /bin/bash
         - -c