Fix pihole for v6: pin digest, listeningMode=ALL, v6 password env, readiness probe

A fresh node pull of pihole:latest silently upgraded v5->v6 (Core v6.2.2).
v6's default listeningMode=LOCAL drops DNS from non-attached subnets, which
killed all cross-node svclb DNS the moment the pod rescheduled off its old
node. v6 also ignores the WEBPASSWORD env.

- image pinned by digest (Core v6.2.2)
- FTLCONF_dns_listeningMode=ALL
- admin password via FTLCONF_webserver_api_password <- pihole-admin secret
- tcpSocket:53 readiness probe so rollout status waits for FTL

Applied to the cluster via kubectl replace; DNS verified answering on all
four node IPs, admin API auth verified.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/pihole/deployment-pihole.yaml

@@ -1,7 +1,13 @@
-# DIVERGENCE from live state (intentional): the live deployment has WEBPASSWORD
-# as a plaintext env value. Here it comes from the `pihole-admin` secret —
-# create it (see secret.example.yaml) BEFORE applying this, or the pod will
-# fail with CreateContainerConfigError.
+# Pi-hole v6 (image pinned by digest = Core v6.2.2 — :latest bit us on
+# 2026-07-26 when a fresh node pull silently jumped v5→v6).
+# v6 notes:
+#  - FTLCONF_dns_listeningMode=ALL is REQUIRED in k8s: the v6 default (LOCAL)
+#    only answers queries from directly-attached subnets, which silently drops
+#    all cross-node svclb traffic.
+#  - v6 ignores the old WEBPASSWORD env; the admin password is
+#    FTLCONF_webserver_api_password, fed from the `pihole-admin` secret —
+#    create it (see secret.example.yaml) BEFORE applying.
+#  - Readiness probe on :53 so rollouts wait for FTL to actually serve DNS.
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -40,12 +46,14 @@ spec:
                       - raspi
       containers:
         - name: pihole
-          image: pihole/pihole:latest
+          image: pihole/pihole@sha256:e28e239f55e648a9d32c8f065650acfe987ddebf1cd5f64f1c071e8716156ceb # Core v6.2.2
           imagePullPolicy: IfNotPresent
           env:
             - name: TZ
               value: America/Los_Angeles
-            - name: WEBPASSWORD
+            - name: FTLCONF_dns_listeningMode
+              value: ALL
+            - name: FTLCONF_webserver_api_password
               valueFrom:
                 secretKeyRef:
                   name: pihole-admin
@@ -72,6 +80,12 @@ spec:
               memory: 2Gi
           securityContext:
             privileged: true
+          readinessProbe:
+            tcpSocket:
+              port: 53
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            failureThreshold: 3
           volumeMounts:
             - name: gv-pihole
               mountPath: /etc/pihole