REG-039 — after (operator placeholder documented + marker asserted)
========================================================================

Row: REG-039 [TRACK-ops] CODE P2 'K8s operator placeholder image' — SEED -> FIXED

Observed BEFORE the edit (the two real gaps):
  $ grep -rn -i 'aegis-operator' docs/DEPLOYMENT_GUIDE.md README.md ...   -> no pointer
     (the only hit tree-wide was docs/REGISTRY.md:137, the row itself)
  $ git grep -n image-required
     deploy/k8s/aegis-operator/deployment.yaml:8      <- annotated, asserted by nothing

The placeholder is a fail-closed control, and stays:
  $ sed -n '31,33p' deploy/k8s/aegis-operator/deployment.yaml
              # No operator image is published by this source contract. Replace this
              # fail-closed reference with an independently reviewed immutable digest.
              image: example.invalid/aegis-operator:unreleased-source-template

  $ sed -n '150,156p' tests/test_deploy_manifests.py
        assert deployment["metadata"]["annotations"]["aegis.io/status"] == (
            "source-template-unreleased"
        )
        assert container["image"].startswith("example.invalid/")
        assert deployment["metadata"]["annotations"]["aegis.io/image-required"] == (
            "replace-with-reviewed-operator-image"
        )

New documentation pointer (docs/operations/DEPLOYMENT_PROFILES.md §3):
    100:**The operator manifest is a source template, not a published artifact.** `deploy/k8s/aegis-operator/` carries a CRD, RBAC, a service account and one `Deployment` whose pod template is hardened (`runAsNonRoot`, `runAsUser: 10001`, `seccompProfile: RuntimeDefault`, `readOnlyRootFilesystem`, `allowPrivilegeEscalation: false`, `drop: [ALL]`) but whose image reference is deliberately a placeholder: `image: example.invalid/aegis-operator:unreleased-source-template`, annotated `aegis.io/status: source-template-unreleased` and `aegis.io/image-required: replace-with-reviewed-operator-image`, with the in-manifest comment "No operator image is published by this source contract. Replace this fail-closed reference with an independently reviewed immutable digest." Both annotations are asserted by `tests/test_deploy_manifests.py`, so the marker cannot be dropped silently. **Nothing in this repository builds or publishes an operator image** — `deploy/docker/` holds only the gateway `Dockerfile` and `Dockerfile.airgap`, and no workflow references the operator — so this manifest cannot start a pod until you supply an image. Pin your own independently reviewed immutable digest; do not replace the placeholder with an unpinned or unread-back tag, which would remove the fail-closed control the test pins. The *workload* image the operator deploys is a different reference and is real and version-pinned to the synchronized release: `ghcr.io/juanlunaia/aegis-latent-core:5.0.0` (`operator.py` `DEFAULT_AEGIS_IMAGE`, `crd.yaml` default), cross-checked by `scripts/verify_release_contract.py`.

The real, version-pinned workload image it contrasts with:
  $ grep -n DEFAULT_AEGIS_IMAGE deploy/k8s/aegis-operator/operator.py
    21:DEFAULT_AEGIS_IMAGE = "ghcr.io/juanlunaia/aegis-latent-core:5.0.0"
    46:    image = spec.get("image", DEFAULT_AEGIS_IMAGE)

Executed:
  $ python -m pytest tests/test_deploy_manifests.py -q
    10 passed in 0.42s
  $ ruff check tests/test_deploy_manifests.py
    All checks passed!

Gates:
verify_docs: PASS (0 findings)
verify_claims: PASS (102 claims, 0 findings)
verify_links: PASS (1285 relative links and anchors resolved)
verify_documentation --strict: status=PASS errors=0 warnings=0
