ip-algo: rename pod field to app; image from pod spec

The `pod` field hashed pod.Name, which differs per replica because of
the ReplicaSet pod-template-hash + 5-char random suffix. With
namespace,pod,image, all replicas of the same Deployment got distinct
hextets even though they were the same workload.

Replace `pod` with `app` — a stable workload identifier derived from
the controller chain:

  - Deployment → ReplicaSet → Pod: strip the pod-template-hash suffix
    from the RS name (`traefik-789df685f` → `traefik`).
  - StatefulSet/DaemonSet/Job → Pod: use controller name as-is.
  - Bare pod: pod name.

Image now comes from pod.Spec.Containers[0].Image (the spec'd
reference). 64-hex-char values are treated as sha256 digests and
parsed as before; everything else (image:tag, short SHA) is FNV-1a-64'd
as a string. This makes `traefik:v3.5` deterministic across replicas
without needing the runtime-resolved digest.

Net effect: namespace,app,image yields identical hextets across all
replicas of the same Deployment except the trailing random N nibble.

embed.Values.Pod → App; AllocRequest.Pod kept for log context only,
new App and Image fields drive the embed call. handlers.go computes
both via deriveAppName + podImageRef helpers.

Tests: 7 new TestDeriveAppName_* cases (Deploy/STS/DS/bare/RS-without-
hash/non-controller-owner) + TestPodImageRef. Existing fuzz seeds
updated for the new keyword.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

pkg/agent/handlers_test.go

@@ -0,0 +1,108 @@
+package agent
+
+import (
+	"testing"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func ptrBool(b bool) *bool { return &b }
+
+func mkPod(name string, owner *metav1.OwnerReference, labels map[string]string, image string) *corev1.Pod {
+	p := &corev1.Pod{
+		ObjectMeta: metav1.ObjectMeta{Name: name, Labels: labels},
+	}
+	if owner != nil {
+		p.OwnerReferences = []metav1.OwnerReference{*owner}
+	}
+	if image != "" {
+		p.Spec.Containers = []corev1.Container{{Image: image}}
+	}
+	return p
+}
+
+func TestDeriveAppName_DeploymentReplicaSet(t *testing.T) {
+	owner := &metav1.OwnerReference{
+		Kind:       "ReplicaSet",
+		Name:       "traefik-789df685f",
+		Controller: ptrBool(true),
+	}
+	pod := mkPod("traefik-789df685f-hqvfl", owner,
+		map[string]string{podTemplateHashLabel: "789df685f"}, "")
+	if got := deriveAppName(pod); got != "traefik" {
+		t.Fatalf("got %q, want %q", got, "traefik")
+	}
+}
+
+func TestDeriveAppName_StatefulSet(t *testing.T) {
+	owner := &metav1.OwnerReference{
+		Kind:       "StatefulSet",
+		Name:       "gitea",
+		Controller: ptrBool(true),
+	}
+	pod := mkPod("gitea-0", owner, nil, "")
+	if got := deriveAppName(pod); got != "gitea" {
+		t.Fatalf("got %q, want %q", got, "gitea")
+	}
+}
+
+func TestDeriveAppName_DaemonSet(t *testing.T) {
+	owner := &metav1.OwnerReference{
+		Kind:       "DaemonSet",
+		Name:       "flock-agent",
+		Controller: ptrBool(true),
+	}
+	pod := mkPod("flock-agent-abcde", owner, nil, "")
+	if got := deriveAppName(pod); got != "flock-agent" {
+		t.Fatalf("got %q, want %q", got, "flock-agent")
+	}
+}
+
+func TestDeriveAppName_BarePod(t *testing.T) {
+	pod := mkPod("standalone", nil, nil, "")
+	if got := deriveAppName(pod); got != "standalone" {
+		t.Fatalf("got %q, want %q", got, "standalone")
+	}
+}
+
+// TestDeriveAppName_RSWithoutTemplateHash — ReplicaSet owners that don't
+// follow the standard "<deploy>-<hash>" naming convention (e.g. a custom
+// controller) keep the RS name as-is. All replicas of that RS still align,
+// which is the second-best correctness offer.
+func TestDeriveAppName_RSWithoutTemplateHash(t *testing.T) {
+	owner := &metav1.OwnerReference{
+		Kind:       "ReplicaSet",
+		Name:       "weird-rs-name",
+		Controller: ptrBool(true),
+	}
+	pod := mkPod("weird-rs-name-xyz", owner, nil, "")
+	if got := deriveAppName(pod); got != "weird-rs-name" {
+		t.Fatalf("got %q, want %q", got, "weird-rs-name")
+	}
+}
+
+func TestDeriveAppName_NonControllerOwnerIgnored(t *testing.T) {
+	// OwnerReference without Controller=true must be ignored — only the
+	// controller owner is the canonical workload.
+	owner := &metav1.OwnerReference{
+		Kind: "Foo",
+		Name: "irrelevant",
+		// Controller pointer left nil.
+	}
+	pod := mkPod("solo", owner, nil, "")
+	if got := deriveAppName(pod); got != "solo" {
+		t.Fatalf("got %q, want %q", got, "solo")
+	}
+}
+
+func TestPodImageRef(t *testing.T) {
+	pod := mkPod("p", nil, nil, "traefik:v3.5")
+	if got := podImageRef(pod); got != "traefik:v3.5" {
+		t.Fatalf("got %q, want %q", got, "traefik:v3.5")
+	}
+	empty := mkPod("p", nil, nil, "")
+	if got := podImageRef(empty); got != "" {
+		t.Fatalf("got %q, want \"\"", got)
+	}
+}