#39 chore(agent-relay): move the GKE proof onto merged relaycast, relayfile and relayhistory builds

Pins the GKE proof overlays to images built from merged code and adds relayfile (actor mode) to the proof.

Images (proof registry awf-conformance-images, linux/amd64, built on sf-frame)

image	source	digest
relaycast-actors-gateway	relaycast main 3624cc12 (#618)	sha256:faf66ec45d2c755ab5cdc6ee32bca6dc48446dff444118cab18fa1f765124ffa
relaycast-actors-deployer	relaycast main 3624cc12	sha256:a81e91ed52bfb7cbb0a8c2773752df3b5d78afdc443608998b3203a30e314cee
relayfile-actors	relayfile main 39f84fcf (#557)	sha256:7fb2110701a004f9f7ed2b025d25156fbe993208598bfbd0498a48b30df48299
relayfile-actors-workspace	relayfile main 39f84fcf	sha256:c5851a1b1f7624390a1a00ebdee69e8e521dc3f23f345c582d62e09dba9a6e83
relayhistory (experimental)	relayhistory-cloud proof/erasure-turns-on-4b5839f @ 3cb76752	sha256:f36ae1671bdcd88a2b8b2df62c8edecb1381237d9f968747b39298959ad33563

Changes

• Digests pinned in values-gcp-proof-durable-actors.yaml, values-gcp-proof-relayfile.yaml, values-gcp-proof-live.yaml; README updated.
• Proof CPU requests sized for the six e2-medium nodes: adding relayfile left the durable-actors pool manager and the relayflows smoke Job unschedulable. durable-actors control plane/pool manager 100m, relayflows smoke Job 100m, relayfile gateway 25m, broker 10m.
• Chart version agent-relay 0.3.2 (0.3.1 is tagged and published): registry row agent-relay-0.3.2 added, 0.3.1 marked shipped, requirements doc re-rendered.
• charts/agent-relay/README.md: step 1 of the write-hold upgrade must not use --wait-for-jobs while the relayflows smoke flow probes History, and a failed step-1 revision leaves the drain Role/RoleBinding behind.

Live

Deployed as helm revision 18 (agent-relay/agent-relay). Render diff against the previous manifest (rev 16) was reviewed object by object: chart version labels, the durable-actors seccompProfile and the pool-manager NetworkPolicy selector from main, the new digests and Job hashes, the relayfile objects, and files.gcp-proof.agentrelay.com on the Ingress and ManagedCertificate.

ci/agent-relay/render.sh: ok. Registry check: OK.

Evidence on the live proof (revision 18)

• scripts/selfhost/e2e-gcp-proof.sh --context awf-gke-iap --secret agent-relay-gcp-proof --require-public (no --allow-known-gap): E2E_RESULT=PASS, 15/15 including case 9 (erasure removes turns).
• relayfile packages/durable-actors/test/e2e/mount-e2e.sh (real Go relayfile-mount) against https://files.gcp-proof.agentrelay.com: ALL PASS (pull, push + op, live WebSocket update, delete, 400 KB blob via GCS); state intact after restarting the gateways and broker.

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}