[kylan11]

Summary

• Add optional Understudy.spec.baselineReplicas for Git-owned desired capacity, with Understudy owning effective Deployment/Rollout replicas.
• Freeze the handover baseline and readiness requirement while the latest desired baseline remains pending; converge after departure, cancellation, or release takeover.
• Expose applied/pending capacity through status.baselineReplicas and the BaselineApplied condition.
• Keep capacity reconciliation active during application release stand-down, including paused Rollouts, and detect Deployment releases that start during a surge.
• Document exact Argo field delegation, first installation, scale-to-zero, CRD upgrades, and ownership retirement.

Approved Q38 contract, originating from the DBRID-2851 consumer-chart handoff.

Verification

• GOTOOLCHAIN=go1.26.1 make lint-fix test: passed; zero lint issues.
• Envtest exercises initial/steady capacity, live drift, pending scale-up and scale-to-zero, latest-value-wins updates, frozen eviction readiness, lost-status recovery, cancellation, release takeover, paused Rollout scaling, and invalid input.
• Helm lint/render, chart metadata validation, generated CRD equality, and diff whitespace checks: passed.
• Live Argo CD 3.5.5 / Rollouts 1.10.1 on Kubernetes 1.36.4 Kind: Deployment, canary, and blue/green all passed initial install, unrelated auto-sync during surge, repeated pending baseline updates, cold operator restart/leadership recovery, 429 hold then admitted eviction, convergence, steady scaling, HTTP serving, and release takeover. Blue/green also passed pending scale-to-zero and subsequent scale-up. Automatic sync and self-heal stayed enabled; Git commits supplied all workload/baseline changes.
• Dedicated Kind clusters were deleted and cleanup confirmed.

Evidence is limited to Argo's ordinary apply path; SSA and force/replace were not exercised. Webhook availability retains the existing fail-open gap during operator restart.

Includes the chart, image metadata, and upgrade notes for release 0.4.4.
The CRD must be upgraded explicitly before enabling baselineReplicas.