CI/CD pipeline

How a change reaches Conrad's production — GitLab CI tests and lint, Kaniko builds the image, assets go to Cloud Storage behind the CDN, Terraform reads secrets and applies the Helm release, and GKE rolls out the pods — plus image tags, deploy ordering and build-once runtime configuration.