release: promote develop → main (installer hardening — OOM gate, apt/needrestart fixes, drift CI)

[saadqbal]

Promotes the unreleased develop commits to main. The installer helper scripts are served from raw.githubusercontent.com/tracebloc/client/main/scripts/ at runtime (bash <(curl -fsSL https://tracebloc.io/i.sh)), so merging this to main ships the installer fixes to users immediately — none of these commits touch the Helm chart templates, so no chart release is required.

Contains (unreleased since v1.5.0)

• fix(installer): hard-gate low RAM and measure the container-runtime's view #217 — hard-gate low RAM + measure the container-runtime's memory view (fixes node OOM on small Ubuntu VMs).
• test(drift): CI guard for source-of-truth drift (backend hosts + workload names) #218 — source-of-truth drift CI guard (CI-only).
• Installer hangs at 'Installing conntrack…' on Ubuntu when the apt/dpkg lock is held (no lock timeout) #210 / fix(installer): bound the apt dpkg-lock wait so a held lock can't hang the install (#210) #211 — bound the apt dpkg-lock wait so a held lock can't hang installs.
• fix(installer): keep apt non-interactive so needrestart can't hang installs on Ubuntu 22.04+ #212 — keep apt non-interactive so needrestart/conntrack can't hang Ubuntu 22.04+ installs.

Chart release (optional — your call)

The chart stays at 1.5.0; nothing in client/ or ingestor/ templates changed. If you want a versioned marker release (as with v1.4.3 "installer hardening"), bump client/Chart.yaml → 1.5.1 and publish a GitHub Release after merge — it's a tracking marker only, since the fix already ships via main.

Gate

Targets main, so fr-gate runs and blocks merge until all contained kanban items (#217, #218, #210, #211, #212) are in Ready for prod.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes install-time gates and Linux package install behavior that affect all new deployments; risk is mitigated by extensive bats/Pester updates and CI-only chart contract tests rather than runtime chart changes.

Overview
Installer hardening so small VMs and flaky Ubuntu apt behavior fail fast instead of hanging or OOMing later. Preflight now uses Docker/Colima VM memory and CPU when the daemon is up (with host fallback), raises floors (5 GB RAM hard-fail on Linux, 10 GB disk), adds train-oriented warnings, and re-checks Docker VM RAM at cluster create (_pf_recheck_runtime_mem / Test-PreflightRuntimeMem). Linux apt paths force non-interactive installs (DEBIAN_FRONTEND, NEEDRESTART_MODE), bound dpkg lock waits (DPkg::Lock::Timeout, apt_wait_for_lock), including get.docker.com and WSL NVIDIA toolkit install. macOS Colima default sizing bumps to 4 CPU / 6 GB RAM.

Adds scripts/tests/check-drift.sh plus a Drift checks GitHub workflow (and shellcheck/bats coverage) to keep backend API hosts and chart workload names aligned with summary.sh / diagnose.sh. Helm unittest files lock down ingestion authz ConfigMap behavior and the stable jobs-manager Service contract (tests only; no template edits in this diff).

^{Reviewed by Cursor Bugbot for commit 6d381f7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 26 / 8

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#102 — chore(kanban): declare staging as prod-truth branch via .kanban.yml · author: @LukasWodka · no reviewer assigned
• averaging-service#103 — fix(averaging): correctness foundations — DP, shape guard, sklearn weighting, bounded ensembles (chore: add default CODEOWNERS for auto-reviewer assignment #73) · author: @LukasWodka · reviewer: @shujaatTracebloc
• backend#732 — feat(experiments): add per-experiment aggregation_strategy field (#730) · author: @LukasWodka · reviewer: @saqlainsyed007, @shujaatTracebloc
• backend#735 — fix(flops): atomic flops_used + fire stop once on threshold crossing (#733) · author: @saadqbal · no reviewer assigned
• cli#64 — release: promote develop → main (toward v0.3.1 — install.sh PATH fix) · author: @saadqbal · no reviewer assigned
• client#207 — test(charts): add helm-unittest suite for ingestion-authz-configmap · author: @saadqbal · no reviewer assigned
• client#216 — test(charts): add helm-unittest suite for jobs-manager-service template · author: @saadqbal · no reviewer assigned
• data-ingestors#156 — harden(time-series): reject locale-ambiguous timestamps (silent mis-parse guard) · author: @LukasWodka · no reviewer assigned
• data-ingestors#158 — harden(image): distinct reasons for unreadable images (empty / corrupt / bomb) · author: @LukasWodka · no reviewer assigned
• data-ingestors#159 — harden(image): validate image↔annotation/mask pairing at ingestion (not mid-training) · author: @LukasWodka · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)