Six differences exist by design and are now recorded in DEVIATIONS with the reason
each one was forced, so the check passes on today's tree and fails on tomorrow's
accident: the four `*-init` Django services folded into their web pods (one migrator
per database), and the two bootstrap Jobs compose runs from the host instead.
Verified against both drift classes by hand: bumping OPENZAAK_TAG in compose alone
reports openzaak + oz-celery, and adding a workload to values.yaml alone reports it
by name.
ADR-0033 shipped the chart with this cost written down: "a second deployment
description to keep in step with compose. Nothing enforces that today; a drift
check belongs in CI (follow-up)." An upstream image bump or a new service applied
to only one of the two files lands unnoticed.
`make k8s-drift` compares what each stack actually deploys — workload names and
resolved container images, from `docker compose config` and a rendered chart —
rather than diffing the two files, which differ by design.
Red: it reports the six differences that exist today, all of them the platform
deviations ADR-0033 forced. Declaring those as intended is the green step.
not