R-1300: SECURITY — cloudflared 2026.10.3 on main (same change as tag v0.345.1); build.sh may push from the pushed tag v<VERSION>

infra.CloudflaredImage 2026.9.3 -> 2026.10.3 (Cloudflare's eMudhra notice, 2026-10-20) and
TestEnsureCloudflared_ANewImageRecreatesTheTunnel (red-proved). build.sh: a --push may build from
the tag v<VERSION> as the server has it, pointing at HEAD (operator's yes 2026-10-26); four new
cases in test_build_push_once.sh, red-proved both ways. MinAgent 0.158.1 unchanged.

controller/internal/infra/infra.go

@@ -20,10 +20,12 @@ import (
 )
 
 // Pinned image tags — NEVER ":latest" (a floating tag breaks reproducible golden bakes and lets the
-// deployed version drift). Verified to resolve on Docker Hub before baking.
+// deployed version drift). Verified to resolve on Docker Hub before baking. cloudflared follows Cloudflare's security
+// notices (felhom.eu `01` „Tunnel placement"): 2026.10.3 since the notice of 2026-10-20 — before 2026.10.2 the image
+// trusts eight eMudhra (emSign) intermediates with weak keys.
 const (
 	TraefikImage     = "traefik:v3.7.13"
-	CloudflaredImage = "cloudflare/cloudflared:2026.9.3"
+	CloudflaredImage = "cloudflare/cloudflared:2026.10.3"
 	FileBrowserImage = "gtstef/filebrowser:1.5.6-stable"
 	// FileBrowserImportMount is the in-container mount point NAME for the canonical drop-zone
 	// (R-75): the bind lands at /srv/<this>. ASCII and space-free on purpose — it appears in a