Harden WebBFF and deployment release behavior

Model fail-closed cross-replica session renewal and implement owner-fenced refresh, transient observer handling, logout fencing, and graceful shutdown. Remove chart-owned Ingress while retaining qualification-owned external routing.

tests/kind/deployment/qualification-ingress.yaml.in

@@ -167,3 +167,29 @@ spec:
             runAsNonRoot: true
             runAsUser: 101
             seccompProfile: {type: RuntimeDefault}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: qualification-remora-route
+  namespace: remora-testbed
+spec:
+  ingressClassName: qualification-nginx
+  rules:
+    - host: qualification-ingress
+      http:
+        paths:
+          - path: /v1
+            pathType: Prefix
+            backend:
+              service:
+                name: remora-remora
+                port:
+                  name: http
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: remora-remora-web
+                port:
+                  name: http

tests/kind/deployment/run.sh

@@ -238,14 +238,6 @@ observability:
   serviceMonitor: {enabled: false, interval: 30s}
   prometheusRule: {enabled: false}
 EOF
-  if [[ "${REMORA_SYSTEM_QUALIFICATION:-0}" = 1 ]]; then
-    cat >> "$RUNTIME/deployment-values.yaml" <<'EOF'
-ingress:
-  enabled: true
-  className: qualification-nginx
-  host: qualification-ingress
-EOF
-  fi
 }
 
 wait_for_queue_length() {
@@ -410,6 +402,10 @@ validate_deployment_assets() {
   grep -q 'absent(remora_ready{component="remora-worker"})' "$RUNTIME/deployment-policy-rendered.yaml"
   grep -q 'automountServiceAccountToken: false' "$RUNTIME/deployment-policy-rendered.yaml"
   grep -q 'readOnlyRootFilesystem: true' "$RUNTIME/deployment-policy-rendered.yaml"
+  if grep -E -q '^kind: (Gateway|HTTPRoute|Ingress)$' "$RUNTIME/deployment-policy-rendered.yaml"; then
+    printf 'chart must not own north-south routing\n' >&2
+    return 1
+  fi
   reject_chart_values "an unprotected target namespace" --set target.exclusiveWriter=false
   reject_chart_values "an unknown top-level value" --set unexpected=true
   reject_chart_values "an unknown nested value" --set runtime.unexpected=true