feat(helm): auto-roll deployment on agent-config change (checksum annotation)

coding-agent/helm/templates/deployment.yaml

@@ -13,10 +13,11 @@ spec:
     metadata:
       labels:
         {{- include "coding-agent.selectorLabels" . | nindent 8 }}
-      {{- with .Values.podAnnotations }}
       annotations:
+        {{- with .Values.podAnnotations }}
         {{- toYaml . | nindent 8 }}
-      {{- end }}
+        {{- end }}
+        checksum/config: {{ include (print $.Template.BasePath "/configmap-agent-config.yaml") . | sha256sum }}
     spec:
       serviceAccountName: {{ include "coding-agent.serviceAccountName" . }}
       automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}

coding-agent/tests/deploy/test_helm_chart.py

@@ -178,6 +178,36 @@ def test_helm_default_runtime_contract_is_runnable() -> None:
     assert "--allow-unauthenticated" not in main["command"]
 
 
+def test_helm_agent_config_checksum_annotation_changes_with_config(
+    tmp_path: Path,
+) -> None:
+    default_docs = _render()
+    custom_docs = _render("--set", "agent.config.model=claude-test-checksum")
+    override_values = tmp_path / "values.yaml"
+    override_values.write_text(
+        "podAnnotations:\n"
+        "  checksum/config: user-override-value\n",
+        encoding="utf-8",
+    )
+    override_docs = _render("-f", str(override_values))
+
+    default_annotations = _deployment(default_docs)["spec"]["template"]["metadata"][
+        "annotations"
+    ]
+    custom_annotations = _deployment(custom_docs)["spec"]["template"]["metadata"][
+        "annotations"
+    ]
+    override_annotations = _deployment(override_docs)["spec"]["template"]["metadata"][
+        "annotations"
+    ]
+
+    assert re.fullmatch(r"[0-9a-f]{64}", default_annotations["checksum/config"])
+    assert re.fullmatch(r"[0-9a-f]{64}", override_annotations["checksum/config"])
+    assert override_annotations["checksum/config"] == default_annotations["checksum/config"]
+    assert override_annotations["checksum/config"] != "user-override-value"
+    assert custom_annotations["checksum/config"] != default_annotations["checksum/config"]
+
+
 def test_helm_default_creates_unprivileged_service_account_without_rbac() -> None:
     docs = _render()