The Caddy image reconcile was gated on `not self.skip_cluster_management`
alongside the install path. With --skip-cluster-management being the
default, that meant spec image changes never propagated on normal
restarts — the operator had to pass --perform-cluster-management for
the reconcile to run, which is surprising and conflates cluster
lifecycle ownership with routine workload reconciliation.
Split the two: install still requires cluster-management ownership
(it seeds namespace + secrets + CronJob, which are cluster-creation
concerns). The update-on-reuse patch is a plain k8s-API operation
against a running Deployment — run it in both modes.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
d65802f8ce