jenkins: rank the controller above its own build agents

The Jenkins controller and the ephemeral build agents it schedules both ran
at priority 0. Because the controller Deployment uses the Recreate strategy,
any JCasC change tears the controller down before its replacement is
scheduled, and while the eligible node pool is saturated that freed slot can
be taken by one of the controller's own pending agents.

That is what happened on 2026-08-23. Merging #48 changed
services/jenkins/configmap-jcasc.yaml, which rolled the hashed
jenkins-jcasc-revision ConfigMap and so rolled the Deployment. At 12:19:57Z
the old controller pod was deleted; at 12:19:59Z the build agent
typhon-133-1pmgb, pending since 11:42:15Z, took the freed capacity on
titan-11, and the new controller pod has been Pending ever since. The
scheduler cannot resolve it because every candidate victim is also priority
0: "No preemption victims found for incoming pod". The agent cannot exit on
its own either, since its jnlp container just loops on "Connection refused"
against the controller that cannot start. It is a self-deadlock, not a
transient capacity dip.

Give the controller a jenkins-core class (500) so it outranks its agents and
can preempt one when it has nowhere else to go, and mark the JCasC default
agent template jenkins-agent (50, preemptionPolicy: Never) so agents never
preempt anything themselves. Values follow the existing *-core/*-sim classes.

The controller-side class is what breaks the deadlock: agents declared inline
by a Jenkinsfile podTemplate, like typhon-133, do not inherit the JCasC
default template, so only the controller's own priority covers every agent.

PriorityClasses ship in infrastructure/modules/base via the core
Kustomization, so jenkins now dependsOn core, matching cassandra and veles.
Verified no dependency cycle: core itself has no dependsOn.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

clusters/atlas/flux-system/applications/jenkins/kustomization.yaml

@@ -16,6 +16,7 @@ spec:
     name: flux-system
   targetNamespace: jenkins
   dependsOn:
+    - name: core
     - name: helm
     - name: harbor
     - name: vault-hermes-jenkins-token-seed

infrastructure/modules/base/priorityclass/jenkins.yaml

@@ -0,0 +1,17 @@
+# infrastructure/modules/base/priorityclass/jenkins.yaml
+apiVersion: scheduling.k8s.io/v1
+kind: PriorityClass
+metadata:
+  name: jenkins-core
+value: 500
+globalDefault: false
+description: "For the Jenkins controller; must outrank the build agents it owns"
+---
+apiVersion: scheduling.k8s.io/v1
+kind: PriorityClass
+metadata:
+  name: jenkins-agent
+value: 50
+globalDefault: false
+preemptionPolicy: Never
+description: "For ephemeral Jenkins build agents; lower than the controller and non-preempting"

infrastructure/modules/base/priorityclass/kustomization.yaml

@@ -4,5 +4,6 @@ kind: Kustomization
 resources:
   - scavenger.yaml
   - cassandra.yaml
+  - jenkins.yaml
   - media.yaml
   - veles.yaml

services/jenkins/configmap-jcasc.yaml

@@ -795,6 +795,7 @@ data:
               slaveConnectTimeoutStr: "100"
               yaml: |
                 spec:
+                  priorityClassName: jenkins-agent
                   securityContext:
                     runAsUser: 1000
                     runAsGroup: 1000

services/jenkins/deployment.yaml

@@ -71,6 +71,12 @@ spec:
         bstein.dev/restarted-at: "2026-05-20T09:40:31Z"
     spec:
       serviceAccountName: jenkins
+      # The controller must outrank the build agents it schedules. Without this
+      # the controller and its agents are both priority 0, so a Recreate
+      # rollout can free the controller's slot only for one of its own agents
+      # to take it, leaving the controller permanently Pending with the
+      # scheduler reporting "No preemption victims found for incoming pod".
+      priorityClassName: jenkins-core
       nodeSelector:
         kubernetes.io/arch: arm64
         node-role.kubernetes.io/worker: "true"