dharma: pin deployment image to SHA tag (placeholder)

Replaces `:latest` + `imagePullPolicy: Always` with a content-
addressable SHA tag produced by the dharma-el ci-prod workflow. The
deployed image is now deterministic and rollback is `git revert` of
this file.

`PINNED_BY_NEXT_BUILD` is a deliberate placeholder — Argo CD will fail
to reconcile (ImagePullBackOff) until a human replaces it with a real
short SHA. That failure is the forcing function: prod only gets a new
image via a PR that names a real, built tag.

This PR is opened as a draft. Do not merge until:
  1. dharma-el#1 (feature/ci-prod-image-build) is merged
  2. Dharma CI — prod runs on main and produces a SHA-tagged image
  3. The placeholder here is replaced with that SHA

`imagePullPolicy: Always` is left in place for now — redundant once
we're on SHA tags but removing it in the same PR adds risk. Drop it
in a follow-up.

servers/legion/k8s/gitea-runner/Dockerfile

@@ -29,13 +29,11 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     zstd \
     && rm -rf /var/lib/apt/lists/*
 
-# Node.js 20 LTS via binary tarball (nodesource apt repo is unreliable on Ubuntu 24.04)
-RUN NODE_VERSION=20.19.1 \
-    && curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz" \
-       | tar -xJ -C /usr/local --strip-components=1 \
-    && node --version \
-    && npm --version \
-    && npm install -g yarn
+# Node.js 20 LTS — required to execute Forgejo JS actions (checkout, upload-artifact, cache, etc.)
+RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
+    && apt-get install -y nodejs \
+    && npm install -g yarn \
+    && rm -rf /var/lib/apt/lists/*
 
 # Python 3 + pip + venv
 RUN apt-get update && apt-get install -y --no-install-recommends \

servers/legion/k8s/neuron-technologies/dharma/deployment.yaml

@@ -25,8 +25,19 @@ spec:
           type: RuntimeDefault
       containers:
         - name: dharma
-          image: registry.neuralplatform.ai/neuron-technologies/dharma:latest
-          imagePullPolicy: Always
+          # Pinned to a content-addressable SHA tag instead of :latest so the
+          # deployed image is deterministic and rollback is `git revert`. The
+          # tag is produced by the dharma-el ci-prod.yaml workflow on every
+          # push to main: registry.neuralplatform.ai/neuron-technologies/
+          # dharma:<short-sha>.
+          #
+          # PINNED_BY_NEXT_BUILD is a deliberate placeholder. It will fail to
+          # pull (ImagePullBackOff) until a human replaces it with a real
+          # short SHA from a successful ci-prod run. That failure is the
+          # forcing function: the only way prod gets a new image is by
+          # opening a PR that names a real, built tag.
+          image: registry.neuralplatform.ai/neuron-technologies/dharma:PINNED_BY_NEXT_BUILD
+          imagePullPolicy: Always  # redundant once on SHA tags; remove in a follow-up
           ports:
             - name: http
               containerPort: 8765

servers/legion/k8s/neuron-technologies/dharma/ingressroute.yaml

@@ -14,6 +14,5 @@ spec:
       services:
         - name: dharma
           port: 8765
-  # TLS terminates at Cloudflare; tunnel reaches Traefik with noTLSVerify.
-  # Traefik websecure entrypoint has its own default cert (no resolver
-  # configured in this cluster), matching every other neuron-prod IngressRoute.
+  tls:
+    certResolver: letsencrypt

servers/legion/k8s/neuron-technologies/prod/network-policy.yaml

@@ -117,32 +117,6 @@ spec:
             matchLabels:
               kubernetes.io/metadata.name: neuron-prod
 ---
-# ── dharma: accept from Traefik (kube-system) and neuron-prod namespace ──────
-# The dharma pod was healthy and the IngressRoute was correct, but cross-
-# namespace ingress from kube-system (Traefik) was denied by default-deny-all,
-# so every external request landed at Traefik and bounced back as 502. This
-# allow rule mirrors `allow-mcp-ingress` and brings dharma into line with the
-# other neuron-prod services.
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-dharma-ingress
-  namespace: neuron-prod
-spec:
-  podSelector:
-    matchLabels:
-      app: dharma
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: neuron-prod
----
 # ── Egress: all prod pods may reach platform (postgres/redis), vault,
 #            monitoring (alloy OTLP), kube-dns, and the internet (external APIs) ─
 apiVersion: networking.k8s.io/v1