chore(#184): pin greenfield ingestor baseline to v0.3.2

[saadqbal]

Summary

Bumps the greenfield-install baseline for the ingestor image to v0.3.2 so brand-new installs start on it immediately, and bumps the client chart version in lockstep. Live clusters already converge to v0.3.2 on their own via image-refresh (float tag 0.3, autoRefresh: true) — this is the explicit-baseline path only. Mirrors #161 (the v0.3.1 baseline bump).

• client/values.yaml images.ingestor.digest: sha256:a0861ea9… (v0.3.1) → sha256:d361fa77… (v0.3.2)
• client/Chart.yaml version + appVersion: 1.4.3 → 1.4.4

The digest is the cosign-signed image from data-ingestors release v0.3.2.

Related

Closes #184

Type of change

• Tech-debt / refactor (release packaging)

What v0.3.2 carries over v0.3.1

• tracebloc/data-ingestors#139 — MLM tokenizer fix, relaxed PascalVOC difficult flag, reserved-id guard (closes Sync develop → main for v1.3.5 chart release #137 / Chart publish: include ingestor subchart in release workflow + CI lint #135)
• First multi-arch ingestor image (amd64 + arm64, Update Helm chart version to 1.0.1 and appVersion to 1.24.15  #24) — arm64 nodes can now run the ingestor

Test plan

• git diff confirms only the two intended lines (digest + chart version/appVersion) changed.
• Digest matches the canonical sha256 in the v0.3.2 GitHub Release notes.
• No template reads a new key, so no nil-guard / --reuse-values risk.

Deployment notes

No rollout action needed for existing clusters — image-refresh already moves them to v0.3.2 within ~15 min of the image push. This only changes what greenfield installs land on.

Checklist

• No secrets / credentials in the diff
• Docs updated if behavior or config changed (the values.yaml comment block)

---

Note

Low Risk
Config-only digest and chart version bump with no template or auth changes; operational impact is limited to greenfield installs and clusters that run helm upgrade with a changed pinned digest.

Overview
Release packaging only: client chart 1.4.3 → 1.4.4 and the greenfield baseline images.ingestor.digest from v0.3.1 to v0.3.2 (cosign-signed sha256). The values.yaml comment block is updated to document what v0.3.2 includes (data-ingestors fixes and multi-arch amd64/arm64).

This follows the same explicit-baseline pattern as #161: new installs get INGESTOR_IMAGE_DIGEST from the pinned value on helm install/upgrade when the chart digest changes. Already-running clusters are unchanged by this PR alone—they keep converging on the float tag 0.3 through the image-refresh CronJob unless an operator upgrades the chart.

No templates, schema keys, or runtime behavior changes beyond which digest greenfield installs start on after upgrade.

^{Reviewed by Cursor Bugbot for commit 0500f1f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 19 / 8

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#98 — ci: add fr-gate caller workflow · author: @LukasWodka · no reviewer assigned
• client#180 — fix(resource-monitor): always grant read-only ClusterRole (decouple from clusterScope) · author: @shujaatTracebloc · reviewer: @saadqbal
• client#183 — fix(rbac): grant get on configmaps/secrets to jobs-manager SA · author: @shujaatTracebloc · reviewer: @saadqbal
• client-runtime#61 — docs: record MySQL credential threat-model decision · author: @saadqbal · no reviewer assigned
• client-runtime#67 — ci: publish jobs-manager images on merge (closes the deploy-delivery gap) · author: @LukasWodka · no reviewer assigned
• client-runtime#68 — fix(pods-monitor): watch the release namespace, not hardcoded "default" · author: @shujaatTracebloc · no reviewer assigned
• client-runtime#70 — fix(Helm chart auto-update — deployed clients stay frozen on installed version #69): don't evict SB sender on payload serialize fail; drop redundant COPY · author: @saadqbal · no reviewer assigned
• client-runtime#71 — test(submit): lock ingestor pod securityContext (regression guard for NetworkPolicy locking down training-pod egress #42/Add consolidated docs/SECURITY.md #44) · author: @LukasWodka · no reviewer assigned
• design-system#19 — fix: un-track coverage/ and node_modules/ from git · author: @LukasWodka · no reviewer assigned
• design-system#22 — ci: add Vitest test workflow · author: @LukasWodka · reviewer: @aptracebloc

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)