k8s(cluster): roll to the frontier-fix image

Also carries the `tmp` fs-backup exclusion committed with the engine fix.

k8s/cluster/statefulset.yaml

@@ -92,7 +92,6 @@ spec:
           imagePullPolicy: IfNotPresent
           command: ["sh", "-c", "mkdir -p /data/db && chown -R 10001:10001 /data/db"]
           securityContext:
-            allowPrivilegeEscalation: false
             runAsUser: 10001
             runAsGroup: 10001
           volumeMounts:
@@ -100,7 +99,7 @@ spec:
               mountPath: /data
       containers:
         - name: tidaldb
-          image: registry.threesix.ai/tidal/server:m12-consumer-readpath-20260818@sha256:9191233d012e41fd92bb6d0efea83b60010995a6fc6e3ebc894f3d7c5f72872a
+          image: registry.threesix.ai/tidal/server:m12-frontier-fix-20260818@sha256:753190984baf19302a1492045b2d4c034693cae31cc2102df073d65927796b8d
           imagePullPolicy: IfNotPresent
           # The image ENTRYPOINT is the bare binary. We override the command with
           # a tiny /bin/sh wrapper (the bookworm-slim runtime HAS a shell) so we