CI-CD: the MTA-STS delta is 2, measured at 60 over 22 on top of rss-bridge

Three rounds were in flight at once and this page already carries the rule
they settled on - a round's figure is its DELTA, because none of the three
branches contained the others. My own paragraph still read "takes it to 58
over 21", which was a running total from before rss-bridge landed and is
now simply wrong.

Restated as a delta of 2, with the figure re-measured after rebasing onto
the landed rss-bridge round: 60 over 22. Named against the 62 over 22 this
page records for rss-bridge plus #122, so the three deltas (+2, +4, +2) are
visible side by side, and the total once all three land is left to be read
off the first run on main that holds them rather than added up here.

Also kept the point that is this round's own: it is the first entry in this
history where the figure grew because a chart ALREADY in the list gained an
object instead of because a chart joined - so the chart count does not move,
and an overlay that was not extended would have left the new route
unrendered.

CI-CD.md

@@ -170,7 +170,11 @@ Group 3 took it to `56` assertions over `21` charts. Its 19 come from six charts
 
 The fail path was exercised rather than assumed: a Service renamed in the route, a port the Service does not expose, a port left out entirely, an emptied `parentRefs` with the chart's own guard disabled, an overlay that renders no route, a run with zero assertions, and — for the pairing — both the redirect rule deleted outright and the redirect pointed at a path other than the one stripped; each produced a `FAIL` naming both sides and a non-zero exit.
 
-**Gitea #123 takes it to `58` over `21`.** `stalwart` grows a second route — the MTA-STS policy hosts — so that chart goes from **2** assertions to **4** while the chart count does not move. That is the ordinary way this figure grows now the sweep is done: a **converted chart gaining an object**, not a new chart. And it only counts because the overlay was extended to enter the new shape (`ci/httproute/stalwart.yaml` now carries an entry with a `clusterIssuer`, one without, and one host on a subdomain) — an overlay left alone would have added a route this test never rendered, which is the anti-vacuum rule biting on a *second* object inside a chart that already passes.
+**The MTA-STS routes of Gitea #123 add `2`**, the third of the three parallel rounds and the one that shows what this figure means from now on: `stalwart` goes from **2** assertions to **4** — one `parentRefs` and one `backendRefs` assertion for its new MTA-STS route — and **the chart count does not move at all.** Every earlier entry in this history grew because a chart *joined* the list; this is the first that grew because a chart already in it gained an **object**. That is the ordinary shape of the next one too, now the sweep is done.
+
+Measured under the same delta rule, and worth stating precisely because three branches were in flight at once: **`60` assertions over `22` charts**, read on a branch that **did** contain `rss-bridge` (it had merged by then) and did **not** contain the realm hostnames of #122. So `58 + 2`. Against the `62/22` above — which is `rss-bridge` plus #122 and not this round — the three deltas are `+2`, `+4` and `+2`, and the total once all three have landed is to be **read off the first run on `main` that holds all of them**, not added up here.
+
+And it only counts because the overlay was extended to enter the new shape (`ci/httproute/stalwart.yaml` carries an entry with a `clusterIssuer`, one without, and one host on a subdomain). An overlay left alone would have added a route this test never rendered — the anti-vacuum rule biting on a **second** object inside a chart that already passes, which is a gap no per-chart "has an overlay" check can see.
 
 Note which half that leaves uncovered: an overlay switches a chart into Gateway mode, so **the Ingress half of a both-modes feature is never rendered here.** For `stalwart`'s MTA-STS objects that half sits in `ci/stalwart/test-values.yaml` instead, where the install-test has a real API server accept them.