deploy: update sme service images to cb1e38d + bump chart to 1.4.236

products/catalyst/chart/Chart.yaml

@@ -2258,8 +2258,8 @@ name: bp-catalyst-platform
 #
 # Refs #1099 (NOT Closes — operator walk + screenshot is the DoD per
 # CLAUDE.md §0).
-version: 1.4.235
-appVersion: 1.4.235
+version: 1.4.236
+appVersion: 1.4.236
 # 1.4.235 — TBD-V55 / #2131 (2026-05-21): catalyst-api one-shot
 # ConfigMap reads in the bp-self-sovereign-cutover handlers now retry
 # with bounded backoff on transient `apiserver not ready` (HTTP 503)

products/catalyst/chart/templates/sme-services/auth.yaml

@@ -24,7 +24,7 @@ spec:
           # contabo-mkt Flux Kustomization (Sovereigns skip via .helmignore),
           # so the image must be a concrete string. PR #580 templated it and
           # pinned the new ReplicaSet at InvalidImageName since 2026-05-02.
-          image: ghcr.io/openova-io/openova/services-auth:f6757c7
+          image: ghcr.io/openova-io/openova/services-auth:cb1e38d
           imagePullPolicy: Always
           ports:
             - containerPort: 8081

products/catalyst/chart/values.yaml

@@ -297,7 +297,7 @@ images:
   admin:
     tag: "3c2f7e4"
   # All 10 SME microservices share one SHA tag (built from the same mono-repo commit).
-  smeTag: "f6757c7"
+  smeTag: "cb1e38d"
 
 # ─── Runtime service coordinates (qa-loop iter-1, cluster
 # `catalyst-runtime-config-missing`) ────────────────────────────────────