Recreate worker-notifications - lost when core namespace got wiped

This StatefulSet was deployed manually outside git at some point before
this repo's GitOps work began, and was destroyed when deleting the core
Kustomization triggered a full namespace recreation (Flux prune-on-delete
cascades regardless of kubectl's --cascade flag - that only affects
Kubernetes' own owner-reference GC, not Flux's finalizer).

Reconstructed from its own logs (NATS_STREAM=NOTIFICATIONS,
NATS_CONSUMER=notifications-worker, FILTER_SUBJECT=api.v1.notifications.push)
plus the same pattern as its sibling workers. Resource limits and
WORKER_CONCURRENCY are a best-guess match to worker-rider-logs, since the
original values were never version-controlled anywhere. Adding it to git
now so this can't happen again.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

manifests/core/kustomization.yaml

@@ -12,6 +12,7 @@ resources:
   - core-config.yaml
   - worker-script.yaml
   - workers.yaml
+  - worker-notifications.yaml
   - worker-pdb.yaml
   - ingress-unified.yaml
   # traefik-middlewares.yaml intentionally excluded - this cluster's

manifests/core/worker-notifications.yaml

@@ -0,0 +1,122 @@
+# Reconstructed manifest - this StatefulSet was originally deployed
+# manually outside of git, and was lost when the core namespace got
+# recreated during the Flux removal incident on 2026-07-20. Rebuilt from
+# its confirmed runtime config (NATS_STREAM/NATS_CONSUMER/FILTER_SUBJECT
+# seen in its own logs) plus the same pattern as its sibling workers.
+# Resource requests/limits and WORKER_CONCURRENCY are best-guess matches
+# to the lightest sibling worker (worker-rider-logs) - adjust if the
+# original values are known.
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: worker-notifications
+  namespace: core
+  labels:
+    app.kubernetes.io/name: worker-notifications
+    app.kubernetes.io/component: worker
+spec:
+  serviceName: "worker-notifications"
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: worker-notifications
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: worker-notifications
+        app.kubernetes.io/component: worker
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "9090"
+        prometheus.io/path: "/metrics"
+    spec:
+      terminationGracePeriodSeconds: 45
+      tolerations:
+      - key: dedicated
+        operator: Equal
+        value: workers
+        effect: NoSchedule
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: node-role.workolik/worker
+                operator: In
+                values:
+                - "true"
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 100
+            podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - worker-notifications
+              topologyKey: kubernetes.io/hostname
+      topologySpreadConstraints:
+      - maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: ScheduleAnyway
+        labelSelector:
+          matchLabels:
+            app.kubernetes.io/name: worker-notifications
+      containers:
+      - name: worker
+        image: workolik360/nats-worker:v1.1.0
+        imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+        command: ["python3", "-u", "/scripts/worker.py"]
+        volumeMounts:
+        - name: worker-script-vol
+          mountPath: /scripts
+        envFrom:
+        - configMapRef:
+            name: core-config
+        env:
+        - name: NATS_STREAM
+          value: "NOTIFICATIONS"
+        - name: NATS_CONSUMER
+          value: "notifications-worker"
+        - name: FILTER_SUBJECT
+          value: "api.v1.notifications.push"
+        - name: WORKER_CONCURRENCY
+          value: "10"
+        - name: NATS_USER
+          valueFrom:
+            secretKeyRef:
+              name: nats-credentials
+              key: username
+        - name: NATS_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: nats-credentials
+              key: password
+        - name: EXTERNAL_ENDPOINT_API_KEY
+          valueFrom:
+            secretKeyRef:
+              name: external-endpoint-secrets
+              key: api_key
+              optional: true
+        - name: EXTERNAL_BASE_URL
+          value: "http://10.43.224.63"
+        resources:
+          requests:
+            memory: "128Mi"
+            cpu: "40m"
+          limits:
+            memory: "128Mi"
+            cpu: "200m"
+        ports:
+        - containerPort: 9090
+          name: metrics
+      volumes:
+      - name: worker-script-vol
+        configMap:
+          name: worker-script