hermes(chat): widen HUX to the fleet and unstick the roll

Removes the canary partition so all four tenants receive the reviewed
build-22 image with the HUX topology and enforcement (every lifecycle
gate passed on ordinal 3). Bumps the hux probe timeouts to 5s: the 2s
readiness exec budget timed out 405 times in 135 minutes on the loaded
ARM node — interpreter spawn cost, not service health — and the
resulting flapping stalled the StatefulSet roll at the canary. Converts
the HUX_IMAGE_TAG/DIGEST setters to block style with the marker on the
value scalar (Flux cannot attach setters inside flow mappings, which
left the metadata stale at build-21) and corrects them to build-22.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BvMSXH8VH2tMWXanb8SJdf

services/hermes/chat-statefulset.yaml

@@ -17,8 +17,6 @@ spec:
     whenScaled: Retain
   updateStrategy:
     type: RollingUpdate
-    rollingUpdate:
-      partition: 3
   selector:
     matchLabels:
       app: hermes-chat-tenant
@@ -593,8 +591,10 @@ spec:
             - {name: HUX_SUBJECT_BINDING_FILE, value: /var/lib/hux/binding/subject}
             - {name: HUX_CONTEXT_KEY_FILE, value: /var/lib/hux/context/context-key}
             - {name: HUX_CANARY_FILE, value: /var/lib/hux/context/redaction-canary}
-            - {name: HUX_IMAGE_TAG, value: 'git-2f535d3a30633c7f3d27c8020c5ca21c0d0f9503-build-21-release'} # {"$imagepolicy": "hermes:hermes-webui-release:tag"}
+            - name: HUX_IMAGE_TAG
-            - {name: HUX_IMAGE_DIGEST, value: 'sha256:e5b9b2fa8296a7b8a6065c63e7b288cd3305d70a3acc4312055b819bb5f64c04'} # {"$imagepolicy": "hermes:hermes-webui-release:digest"}
+              value: git-91cfb901a2710d00b8fc7f5d685c507d132eec25-build-22-release # {"$imagepolicy": "hermes:hermes-webui-release:tag"}
+            - name: HUX_IMAGE_DIGEST
+              value: sha256:2313d0d5b6042bda728745163fef9e8ce6c94541108e735e71c2841b3b898955 # {"$imagepolicy": "hermes:hermes-webui-release:digest"}
             - {name: HUX_SWITCHYARD_ROUTE_CATALOG, value: 'atlas/manual/codex/luna,atlas/manual/codex/terra,atlas/manual/codex/sol,atlas/manual/claude/haiku,atlas/manual/claude/fable,atlas/manual/claude/sonnet,atlas/manual/claude/opus,atlas/manual/local/qwen-14b'}
             - {name: HUX_RELEASE_EVIDENCE_KEY_FILE, value: /run/hermes-hux-evidence/evidence-key}
             - {name: HUX_RELEASE_EVIDENCE_POLICY_FILE, value: /etc/hux-evidence/policy.json}
@@ -616,7 +616,7 @@ spec:
                 - "import json,urllib.request; body=json.load(urllib.request.urlopen('http://127.0.0.1:8790/healthz', timeout=2)); assert body['status']=='ok'"
             initialDelaySeconds: 2
             periodSeconds: 5
-            timeoutSeconds: 2
+            timeoutSeconds: 5
             failureThreshold: 12
           livenessProbe:
             exec:
@@ -626,7 +626,7 @@ spec:
                 - "import json,urllib.request; body=json.load(urllib.request.urlopen('http://127.0.0.1:8790/healthz', timeout=2)); assert body['status']=='ok'"
             initialDelaySeconds: 20
             periodSeconds: 20
-            timeoutSeconds: 3
+            timeoutSeconds: 5
           securityContext:
             allowPrivilegeEscalation: false
             capabilities: