Harden WebBFF and deployment release behavior

Model fail-closed cross-replica session renewal and implement owner-fenced refresh, transient observer handling, logout fencing, and graceful shutdown. Remove chart-owned Ingress while retaining qualification-owned external routing.

tests/kind/deployment/qualification-ingress.yaml.in

@@ -167,3 +167,29 @@ spec:
             runAsNonRoot: true
             runAsUser: 101
             seccompProfile: {type: RuntimeDefault}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: qualification-remora-route
+  namespace: remora-testbed
+spec:
+  ingressClassName: qualification-nginx
+  rules:
+    - host: qualification-ingress
+      http:
+        paths:
+          - path: /v1
+            pathType: Prefix
+            backend:
+              service:
+                name: remora-remora
+                port:
+                  name: http
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: remora-remora-web
+                port:
+                  name: http