ci(hermes): move WebUI builds off storage nodes

ci/Jenkinsfile.hermes-webui-image

@@ -18,7 +18,6 @@ spec:
     fsGroupChangePolicy: OnRootMismatch
   nodeSelector:
     kubernetes.io/arch: arm64
-    node-role.kubernetes.io/worker: "true"
   affinity:
     nodeAffinity:
       requiredDuringSchedulingIgnoredDuringExecution:
@@ -26,9 +25,11 @@ spec:
           - matchExpressions:
               - key: kubernetes.io/hostname
                 operator: In
+                # Keep disposable Kaniko expansion off the astreae Longhorn
+                # replica nodes. titan-20 is the roomy ARM image builder and
+                # has local NVMe for this transient I/O.
                 values:
-                  - titan-15
-                  - titan-17
+                  - titan-20
   imagePullSecrets:
     - name: harbor-bstein-robot
   containers:

testing/tests/test_hermes_webui_release.py

@@ -122,10 +122,13 @@ def test_pipeline_builds_latest_main_containing_reviewed_anchor() -> None:
     assert "kaniko" in containers
     assert containers["kaniko"]["resources"]["requests"]["ephemeral-storage"] == "10Gi"
     assert containers["kaniko"]["resources"]["limits"]["ephemeral-storage"] == "20Gi"
+    assert spec["nodeSelector"] == {"kubernetes.io/arch": "arm64"}
     build_nodes = spec["affinity"]["nodeAffinity"][
         "requiredDuringSchedulingIgnoredDuringExecution"
     ]["nodeSelectorTerms"][0]["matchExpressions"][0]["values"]
-    assert build_nodes == ["titan-15", "titan-17"]
+    assert build_nodes == ["titan-20"]
+    storage_nodes = {"titan-13", "titan-15", "titan-17", "titan-19"}
+    assert storage_nodes.isdisjoint(build_nodes)
     assert "docker.sock" not in source and "hostPath" not in source
     for container in containers.values():
         assert container["securityContext"]["allowPrivilegeEscalation"] is False