In-Cluster Reconciliation (Flux) Diagram

Tracking vs pin

track: candidate -> semver >=202610.0.0-0, filter .*-candidate$
version: <CalVer>-approved -> tag (a pin)
Pull uses Secret acr-pull-secret

CI waits, Flux applies

cd-deploy-environment requests a reconcile
Waits for HelmRelease at the chart version and Ready
Then ExternalSecrets synced, Deployments available

Version = tag

helm-controller needs OCI tag == chart version
Compose builds <v>-candidate as the chart version
Approval repackages <v>-approved; deploys check the digest