chrome-service: reconcile state after pipeline #366 was killed mid-apply + document cancel-previous hazard

Pipeline #366 (the SHA-pin apply, commit 7b4a8ba8) was SIGKILLed mid-apply by
Woodpecker cancel-previous when I pushed the next commit (#367, docs) while it
was still running — the apply log ends at '[chrome-service] Starting apply...'
with no 'Apply complete!', so the terraform state write did not finish. The live
deployment is correct (image = the supervised SHA, verified, self-healing), but
the stored state may be stale; this commit re-triggers a clean changed-stack
apply to reconcile it (comment-only change → 0 resource changes, no rollout).

Also adds a caution to the novnc image comment: after bumping the SHA, WAIT for
the apply pipeline to finish before pushing again (memory id=1957).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

stacks/chrome-service/main.tf

@@ -337,7 +337,10 @@ resource "kubernetes_deployment" "chrome_service" {
           # (keel.sh/policy=never, below) and :latest/IfNotPresent won't re-pull a
           # rebuilt image, so a new noVNC entrypoint only deploys when this digest
           # is bumped here. Bump after build-chrome-service-novnc.yml pushes a new
-          # SHA tag. 2026-06-27: bumped to land the x11vnc-supervision self-heal fix
+          # SHA tag — then WAIT for that apply pipeline to finish before pushing
+          # anything else: Woodpecker cancel-previous SIGKILLs an in-flight apply
+          # mid-run (memory id=1957), which is exactly how the 2026-06-27 apply got
+          # killed. 2026-06-27: bumped to land the x11vnc-supervision self-heal fix
           # (noVNC went black after a browser-container restart; see
           # docs/architecture/chrome-service.md "x11vnc supervision").
           image             = "ghcr.io/viktorbarzin/chrome-service-novnc:19d0f0933a8ec75be6cfa077db88e0f8c3760f40"