- Upgrade CI deploy to Helm 4.1 with --rollback-on-failure --wait=watcher - Replace initialDelaySeconds with startup probe (15x2s=30s window) - Set resources req=limit (100m/128Mi) for Guaranteed QoS class - Add ConfigMap checksum annotation to trigger rollouts on config changes