k8s: pin server 2.6.2

git.stinnesbeck.com/nils/mg4-server:2.6.2 at
sha256:e4de1e75958d58ece8430a1913f9c1614d8ea1bf566f2e1ec5b449ef51844f77
(update logging, Go 1.27.3).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LhzAVaUyqcw5PkGjz4mWW6

SPECS.md

@@ -39,8 +39,8 @@ car ──live telemetry───▶ car.k8s.stinnesbeck.com (Go)
 
 ### Status
 
-Current: app 2.35.3, server 2.6.1 (pinned by digest in `k8s/server.yaml`; applied and running
-on the cluster since 2026-10-25).
+Current: app 2.35.3; server 2.6.2 pinned by digest in `k8s/server.yaml` (2.6.1 running on the
+cluster until it is applied).
 
 - [x] On the car: QR pairing, values on the Overview, voice-key double press, full screen
       without black bands.
@@ -145,7 +145,9 @@ tyre pressures, GPS (lat, lon, elevation, heading) and the is_* flags. It does *
   forge address or token in the log (tested: `TestUpdatesAreLogged`). Go 1.27.3 (build image
   and `go.mod` toolchain), up from 1.26.9: `govulncheck` had found GO-2026-6809 (compromised
   intermediate certificates, `crypto/x509`, reached through the server's TLS); now no
-  vulnerabilities, in the source and in the built binary. go vet, tests, podman build.
+  vulnerabilities, in the source and in the built binary. go vet, tests, podman build. Pushed
+  as `mg4-server:2.6.2` (`sha256:e4de1e75…`, checked in the registry) and pinned in
+  `k8s/server.yaml`.
 - 2026-10-25 — `k8s/influxdb.yaml`: the values Kubernetes fills in itself are written out — the
   NetworkPolicy port's `protocol: TCP`, and `apiVersion`, `kind` and `volumeMode: Filesystem` on
   the StatefulSet's volume claim template. Without them every `kubectl apply -k k8s/` reported