deployment: replace in place — one replica, one node, no room to surge (tablet 31)

The default RollingUpdate (maxSurge 25% → one extra pod) needs 450m CPU
beside the running pod; the node has 1700m allocatable and 1470m
requested. The Tablet-30 rollout sat Pending for five minutes while the
old image kept serving. maxSurge 0 / maxUnavailable 1: the old pod goes
first, the new one schedules, and is Ready once the kohen writes manna.
Patched live 2026-10-04; this makes the manifest match.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/k8s/deployment.yaml

@@ -19,6 +19,16 @@ metadata:
     app.kubernetes.io/version: "0.1.0"
 spec:
   replicas: 1
+  # One replica on one node with no room to surge. The default
+  # (maxSurge 25% → 1 extra pod) asks for 450m CPU the node does not
+  # have beside the running pod, and the rollout hangs Pending while the
+  # old image keeps serving (tablet 31, 2026-10-04). Replace in place.
+  # The new pod is not Ready until the kohen writes manna (emptyDir).
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 0
+      maxUnavailable: 1
   selector:
     matchLabels:
       app.kubernetes.io/name: shorashim