ci: deploy :latest with rollout restart, single replica

Drop the sha-pinned overlay and automatic rollback. The deployment now
runs 1 replica with imagePullPolicy Always, and CI restarts it after
apply so the new :latest image is pulled.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.github/workflows/deploy.yml

@@ -74,7 +74,6 @@ jobs:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
             type=raw,value=latest
-            type=sha,format=long
 
       - name: Build and push image
         uses: docker/build-push-action@v7
@@ -119,34 +118,22 @@ jobs:
 
           KUBECONFIG="${KUBECONFIG_PATH}" kubectl cluster-info --request-timeout=15s
 
-      # Overlay that pins the image to this commit, using kubectl's built-in kustomize.
-      - name: Pin image to this commit
-        run: |
-          mkdir -p k8s-deploy
-          cat > k8s-deploy/kustomization.yaml <<EOF
-          apiVersion: kustomize.config.k8s.io/v1beta1
-          kind: Kustomization
-          resources:
-            - ../k8s
-          images:
-            - name: ${REGISTRY}/${IMAGE_NAME}
-              newTag: sha-${GITHUB_SHA}
-          EOF
-          kubectl kustomize k8s-deploy/ | grep 'image:'
-
       - name: Apply manifests
-        run: kubectl apply -k k8s-deploy/
+        run: kubectl apply -k k8s/
+
+      # The spec still says :latest, so force new pods to pull the image just pushed.
+      - name: Restart deployment
+        run: kubectl rollout restart "deployment/${DEPLOYMENT}" -n "${NAMESPACE}"
 
       - name: Wait for rollout
         run: |
           if ! kubectl rollout status "deployment/${DEPLOYMENT}" -n "${NAMESPACE}" --timeout=5m; then
             kubectl get pods -n "${NAMESPACE}" -o wide
             kubectl describe pods -n "${NAMESPACE}" | tail -40
-            kubectl rollout undo "deployment/${DEPLOYMENT}" -n "${NAMESPACE}" || true
             exit 1
           fi
 
       - name: Verify deployment
         run: |
           kubectl get deployments,pods,services,ingress -n "${NAMESPACE}"
-          echo "### Deployed sha-${GITHUB_SHA} to ${NAMESPACE}" >> "${GITHUB_STEP_SUMMARY}"
+          echo "### Deployed ${GITHUB_SHA} to ${NAMESPACE}" >> "${GITHUB_STEP_SUMMARY}"