Harden WebBFF and deployment release behavior

Model fail-closed cross-replica session renewal and implement owner-fenced refresh, transient observer handling, logout fencing, and graceful shutdown. Remove chart-owned Ingress while retaining qualification-owned external routing.

tests/kind/deployment/run.sh

@@ -238,14 +238,6 @@ observability:
   serviceMonitor: {enabled: false, interval: 30s}
   prometheusRule: {enabled: false}
 EOF
-  if [[ "${REMORA_SYSTEM_QUALIFICATION:-0}" = 1 ]]; then
-    cat >> "$RUNTIME/deployment-values.yaml" <<'EOF'
-ingress:
-  enabled: true
-  className: qualification-nginx
-  host: qualification-ingress
-EOF
-  fi
 }
 
 wait_for_queue_length() {
@@ -410,6 +402,10 @@ validate_deployment_assets() {
   grep -q 'absent(remora_ready{component="remora-worker"})' "$RUNTIME/deployment-policy-rendered.yaml"
   grep -q 'automountServiceAccountToken: false' "$RUNTIME/deployment-policy-rendered.yaml"
   grep -q 'readOnlyRootFilesystem: true' "$RUNTIME/deployment-policy-rendered.yaml"
+  if grep -E -q '^kind: (Gateway|HTTPRoute|Ingress)$' "$RUNTIME/deployment-policy-rendered.yaml"; then
+    printf 'chart must not own north-south routing\n' >&2
+    return 1
+  fi
   reject_chart_values "an unprotected target namespace" --set target.exclusiveWriter=false
   reject_chart_values "an unknown top-level value" --set unexpected=true
   reject_chart_values "an unknown nested value" --set runtime.unexpected=true