R-1300: SECURITY — cloudflared 2026.10.3 on main (same change as tag v0.345.1); build.sh may push from the pushed tag v<VERSION>

infra.CloudflaredImage 2026.9.3 -> 2026.10.3 (Cloudflare's eMudhra notice, 2026-10-20) and
TestEnsureCloudflared_ANewImageRecreatesTheTunnel (red-proved). build.sh: a --push may build from
the tag v<VERSION> as the server has it, pointing at HEAD (operator's yes 2026-10-26); four new
cases in test_build_push_once.sh, red-proved both ways. MinAgent 0.158.1 unchanged.

controller/internal/infra/infra.go

@@ -20,10 +20,12 @@ import (
 )
 
 // Pinned image tags — NEVER ":latest" (a floating tag breaks reproducible golden bakes and lets the
-// deployed version drift). Verified to resolve on Docker Hub before baking.
+// deployed version drift). Verified to resolve on Docker Hub before baking. cloudflared follows Cloudflare's security
+// notices (felhom.eu `01` „Tunnel placement"): 2026.10.3 since the notice of 2026-10-20 — before 2026.10.2 the image
+// trusts eight eMudhra (emSign) intermediates with weak keys.
 const (
 	TraefikImage     = "traefik:v3.7.13"
-	CloudflaredImage = "cloudflare/cloudflared:2026.9.3"
+	CloudflaredImage = "cloudflare/cloudflared:2026.10.3"
 	FileBrowserImage = "gtstef/filebrowser:1.5.6-stable"
 	// FileBrowserImportMount is the in-container mount point NAME for the canonical drop-zone
 	// (R-75): the bind lands at /srv/<this>. ASCII and space-free on purpose — it appears in a

controller/internal/stacks/infra_tunnel_test.go

@@ -326,3 +326,33 @@ func TestEnsureForwardedHeaders_R1033_RewritesAnOldFile(t *testing.T) {
 		t.Fatal("the rewritten file must carry the https-only redirect")
 	}
 }
+
+// A controller update that changes only cloudflared's IMAGE recreates the running container on the new image (the
+// 2026.10.3 security bump rides this: no other step moves a household's tunnel). The control: the same render again
+// is a no-op.
+func TestEnsureCloudflared_ANewImageRecreatesTheTunnel(t *testing.T) {
+	state := stubDocker(t)
+	touch(t, filepath.Join(state, "running-cloudflared"), "")
+	m, calls := tunnelTestManager(t, "")
+	dir := t.TempDir()
+	cur, _ := infra.RenderCloudflared(infra.CloudflaredData{CFTunnelToken: "tok-test", Tunnel: true})
+	old := strings.Replace(cur["docker-compose.yml"].Content, "image: "+infra.CloudflaredImage, "image: cloudflare/cloudflared:2026.9.3", 1)
+	if old == cur["docker-compose.yml"].Content {
+		t.Fatal("the render has no `image:` line to age — the test would prove nothing")
+	}
+	touch(t, filepath.Join(dir, "docker-compose.yml"), old)
+
+	if err := m.ensureCloudflared(dir, true); err != nil {
+		t.Fatalf("ensureCloudflared: %v", err)
+	}
+	cmp, _ := os.ReadFile(filepath.Join(dir, "docker-compose.yml"))
+	if !strings.Contains(string(cmp), "image: "+infra.CloudflaredImage) {
+		t.Fatalf("the compose must carry %s:\n%s", infra.CloudflaredImage, cmp)
+	}
+	if len(*calls) != 1 || (*calls)[0].args != "up -d" {
+		t.Fatalf("want one `up -d` (compose recreates on the new image), got %+v", *calls)
+	}
+	if err := m.ensureCloudflared(dir, true); err != nil || len(*calls) != 1 {
+		t.Fatalf("an unchanged image must not recreate the tunnel again; err %v calls %+v", err, *calls)
+	}
+}