Strip sha256 hash and update to 2026.8.3

test.sh

@@ -1,9 +1,15 @@
 #!/usr/bin/env bash
 set -euo pipefail
 dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd); work=$(mktemp -d); trap 'rm -rf "${work}"' EXIT
-sh -n "$dir/install.sh"; bash -n "$dir/render.sh" "$dir/create-ci-kubeconfig.sh" "$dir/test.sh"
+sh -n "$dir/install.sh" "$dir/update-outpost-images.sh"; bash -n "$dir/render.sh" "$dir/create-ci-kubeconfig.sh" "$dir/test.sh"
 "$dir/render.sh" "$work/authentik.yaml"
 grep -Eq '^kind: Secret$' "$work/authentik.yaml" && { echo "Chart rendered a Secret" >&2; exit 1; }
-image=ghcr.io/yannh/kubeconform:v0.7.0@sha256:85dbef6b4b312b99133decc9c6fc9495e9fc5f92293d4ff3b7e1b30f5611823c
+image=ghcr.io/yannh/kubeconform:v0.7.0
 for file in "$work/authentik.yaml" "$dir/authentik-outpost-path.yaml" "$dir/authentik-media-redirect.yaml" "$dir/ci-deployer.yaml"; do docker run --rm -i "$image" -strict -exit-on-error -ignore-missing-schemas -summary < "$file"; done
+grep -q 'replicas: 2' "$work/authentik.yaml"
+grep -q 'cpu: 500m' "$work/authentik.yaml"
+if grep -Eq 'router.middlewares:|inFlightReq:|rateLimit:' "$work/authentik.yaml" "$dir/authentik-outpost-path.yaml"; then
+  echo "Public Authentik request limiting must remain disabled." >&2
+  exit 1
+fi
 echo "Authentik public desired state is valid and contains no Secrets."