fix(hermes-voice): unpack Jetson image capabilities

ci/Jenkinsfile.hermes-voice-image

@@ -71,7 +71,10 @@ spec:
         allowPrivilegeEscalation: false
         capabilities:
           drop: ["ALL"]
-          add: ["CHOWN", "FOWNER", "DAC_OVERRIDE", "SETGID", "SETUID"]
+          # The pinned Jetson Whisper base contains gst-ptp-helper with a
+          # security.capability xattr. Kaniko needs SETFCAP only while
+          # unpacking that reviewed base; the pod remains non-privileged.
+          add: ["CHOWN", "FOWNER", "DAC_OVERRIDE", "SETGID", "SETUID", "SETFCAP"]
         runAsUser: 0
         seccompProfile: {type: RuntimeDefault}
       resources:

services/jenkins/configmap-jcasc.yaml

@@ -702,6 +702,7 @@ data:
           }
           pipelineJob('hermes-voice-image') {
             disabled(false)
+            concurrentBuild(false)
             description('Bounded daemonless Kaniko release for reviewed Hermes STT or TTS source. A validated immutable release tag is consumed by Flux.')
             authenticationToken(System.getenv('HERMES_AGENT_IMAGE_BUILD_TOKEN'))
             parameters {

testing/tests/test_hermes_voice_release.py

@@ -20,6 +20,8 @@ def test_voice_pipeline_binds_component_source_digest_and_release() -> None:
     assert "PUBLISH HERMES STT" in pipeline
     assert "PUBLISH HERMES TTS" in pipeline
     assert "archiveArtifacts(" in pipeline
+    assert '"SETFCAP"' in pipeline
+    assert "privileged: true" not in pipeline
 
 
 def test_jenkins_declares_one_token_guarded_voice_job() -> None:
@@ -29,6 +31,7 @@ def test_jenkins_declares_one_token_guarded_voice_job() -> None:
         "multibranchPipelineJob('titan-iac-quality-gate')", 1
     )[0]
     assert "authenticationToken(System.getenv('HERMES_AGENT_IMAGE_BUILD_TOKEN'))" in block
+    assert "concurrentBuild(false)" in block
     assert "scriptPath('ci/Jenkinsfile.hermes-voice-image')" in block