feat(chart): krateo-sse-proxy 0.1.15 — image 1.1.9, the sargable poll cursor and windowed /events

[braghettos]

Bumps the sse-proxy image to 1.1.9 (krateo-platformops/sse-proxy#25, PR #26 merged as f1d87504; tag 1.1.9 peels to that commit; the image ghcr.io/krateo-platformops/sse-proxy:1.1.9 exists). The templates are unchanged.

What 1.1.9 fixes (measured on krateo-057, read-only)

• Poll cursor. toUnixTimestamp(Timestamp) > N becomes Timestamp >= toDateTime64(N+1, 9), which selects the same rows. EXPLAIN indexes=1 per poll: 53 parts / 731 granules → 1 part / 1 granule. Before the fix, the poller used ~3.25 of ClickHouse's 4-core limit (~828 polls an hour, ~4.25M rows each), and ClickHouse sat at its CPU limit.
• /events. Newest window first (1h, 24h, then unbounded). Results are identical to the unbounded query; granules read: unfiltered 730 → 4, devday-milan 528 → 86. Equivalence was checked on 057 with pinned samples (count + cityHash64 match).
• Independent gate: reviewer-small PASS from pushed SHA f61dd601.

Diff

• Chart.yaml: version 0.1.14 → 0.1.15, appVersion "1.1.8" → "1.1.9", plus a changelog comment in the existing house style.
• values.yaml: image.tag "1.1.8" → "1.1.9". This is required: deployment.yaml renders krateo.image with .Chart.AppVersion only as the default tag, and the pinned image.tag wins. With an appVersion-only bump, helm template still renders sse-proxy:1.1.8. feat(charts): collector 0.3.8 (image 1.0.4) + sse-proxy 0.1.13 (image 1.1.7) #65 and feat(chart): krateo-sse-proxy 0.1.14 — image 1.1.8, the map-only events predicate #67 bumped both fields for the same reason.

Verified locally: helm lint passes, and helm template renders image: "ghcr.io/krateo-platformops/sse-proxy:1.1.9". gitleaks: no leaks.

Publishing (do not reuse tag 0.1.15)

release-oci.yaml fires on any X.Y.Z tag. Each run packages every first-class chart under charts/ at the literal version in its own Chart.yaml, then pushes all of them. None of these charts uses the CHART_VERSION/APP_VERSION placeholders, so the tag name only triggers the run; it does not version anything. Tag 0.1.15 already exists (2026-09-02, on 4679ee5), so it cannot be pushed again. Publish with a workflow_dispatch of release-oci on main after this merges (inputs can stay empty), or by pushing a new unused tag on the merge commit.

No roll is requested here.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EzZ1gXDHbHVhPh2bbE8yfi