feat(sms-bridge): select safe telemetry image

[xnoto]

Summary

Selects the published PII-safe SMS bridge telemetry image fe2c1cb435ca5f2f2c657f7b73a5d15c1ba95070 in the existing opencode-sms-bridge Application.

Fixes #

None — owner-approved deployment of the published telemetry image.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — test run 33942414686 passed repository pre-commit validation.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — no generated files changed.
• Diff manually verified: exactly one immutable image-tag replacement in the existing Application; chart version, route, Secret references, sender allowlist, and number-to-agent routing are unchanged.

No local Kubernetes, Kustomize, SOPS, OpenTofu, or image operation was run or claimed. CI is the validation authority.

Impact and rollout

Producer: images PR #32 is merged at fe2c1cb4, and its successful main buildah run 33942142243 published the exact immutable image selected here.

Consumer: workloads/apps/opencode-sms-bridge-app.yaml changes the Helm image tag only. The current bridge chart 0.1.2, opencode namespace, Service, PVC, TunnelBinding, encrypted Secrets, sender allowlist, fixed agent mapping, and Twilio webhook configuration are unchanged.

Authorized delivery path: after merge, main test must pass; then the repository sync workflow requests reconciliation of gitops-workloads at the tested Git revision. The workload root must update this child Application, and the child automated policy must reconcile the selected image. Verify root/child revisions, sync, health, resource tree, Deployment rollout, and both container statuses before repeating the authorized SMS test. This PR itself does not prove any of those stages.

Rollback: select the previous known-good immutable image tag 8fbb926ea958fff53edff11238891ac84c4da305 through a reviewed GitOps change; never retag published images or patch the live Deployment.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes.

GitHub Advanced Security secret scanning is unavailable for this repository; the one-line diff was manually reviewed. AI-assisted change: an OpenCode agent materially produced this change; reviewers should verify the exact immutable image tag and retained ownership boundaries before merging.