Use Atomic Deployments in CI/CD

This rule applies to files matching the patterns above.

# Use Atomic Deployments in CI/CD

## Rule
All Helm upgrade/install commands in CI/CD MUST use `--atomic` and `--timeout` flags. Production deployments MUST also use `--wait` to verify resource readiness.

## Required Flags
```bash
helm upgrade --install myapp ./chart \
  --namespace production \
  --atomic \              # Auto-rollback on failure
  --wait \                # Wait for resources to be ready
  --timeout 5m \          # Maximum wait time
  --history-max 5          # Limit release history
```

## Good Examples
```bash
# CI/CD deployment (all safety flags)
helm upgrade --install myapp ./chart \
  -f values-production.yaml \
  --namespace production \
  --create-namespace \
  --atomic \
  --wait \
  --timeout 10m \
  --history-max 5

# With diff check first
helm diff upgrade myapp ./chart -f values-production.yaml -n production
helm upgrade --install myapp ./chart -f values-production.yaml -n production --atomic --timeout 5m
```

## Bad Examples
```bash
# BAD: No atomic flag (broken releases stay broken)
helm upgrade myapp ./chart -f values.yaml

# BAD: No timeout (waits forever on stuck pods)
helm upgrade --install myapp ./chart --wait

# BAD: No wait (reports success before pods are ready)
helm upgrade --install myapp ./chart --atomic
```

## What --atomic Does
1. Sets `--wait` automatically
2. Monitors pod rollout status
3. If ANY resource fails to become ready within timeout:
   - Automatically rolls back to the previous release
   - Marks the release as FAILED
   - Returns non-zero exit code (fails CI pipeline)

## Enforcement
- CI/CD templates must include --atomic --timeout flags
- Code review for deployment scripts
- Wrapper scripts that enforce these flags by default