LCORE-2664: extend automation decision S4 with podman-only reference

Per PM review on the spike PR (sbunciak, 2026-07-21): teams with
podman-only deployments need a non-Kubernetes automation reference.

Spike doc: Decision S4 gains option D (CronJob reference manifest plus a
podman Quadlet reference — .container + .timer systemd units driving the
same importer container, plain-cron fallback noted) and D becomes the
recommendation, PM-confirmed. The scheduled-refresh JIRA stub's scope and
acceptance criteria now cover both deployment shapes.

Spec doc kept in sync: R9 and its acceptance-test-surface row cover the
Quadlet reference, the rollout plan names systemctl restart alongside
kubectl rollout restart, the key-files table adds the Quadlet example
units, and the changelog records the amendment.

Author: max-svistunov

docs/design/byok-confluence-import/byok-confluence-import-spike.md

@@ -103,13 +103,21 @@ LCORE-788 asks for "an automation Lightspeed admins can deploy".
 | A. Documented Kubernetes CronJob reference manifest | Wraps the importer container; portable to any k8s/OpenShift cluster |
 | B. Shipwright BuildStrategy | Extends the s2i PoC; OCP-specific, assumes image contract + registry |
 | C. Docs only | Ship the importer CLI/container; scheduling left entirely to admins |
+| D. A + podman/systemd-timer reference | A, plus a Quadlet (`.container` + `.timer` systemd units) reference for podman-only hosts |
 
-**Recommendation**: A — CronJob reference manifest + admin guide in
+**Recommendation**: D — CronJob reference manifest + admin guide in
 rag-content, documenting the DB-file flow (shared volume + rollout
-trigger). Note B as the natural OLS product-layer variant built on the
-same importer container.
+trigger), **plus a podman-only reference**: Quadlet systemd units
+(`.container` + `.timer`) running the same importer container on a
+schedule, with a plain-cron one-liner noted as the minimal fallback.
+Both references drive the identical container image and flags — the
+automation layer is thin by design. Note B as the natural OLS
+product-layer variant built on the same importer container.
 
-**Confidence**: 78%
+*2026-07-21: extended from A to D per PM review on the spike PR
+(non-Kubernetes deployments must be covered).*
+
+**Confidence**: 88% (PM-confirmed with the podman amendment)
 
 ### Decision S5: Lightspeed-stack config surface
 
@@ -416,20 +424,25 @@ in lightspeed-core/rag-content.
 
 <!-- type: Task -->
 <!-- key: LCORE-???? -->
-#### LCORE-???? CronJob reference manifest and admin automation guide
+#### LCORE-???? Scheduled-refresh references (CronJob, podman/systemd) and admin automation guide
 
-**Description**: Reference Kubernetes CronJob manifest running the importer
-container on a schedule (shared volume for the artifact + state; rollout
-trigger for lightspeed-stack), plus the admin guide covering credentials
-(Secret; service-account recommendation), scheduling, staleness
-expectations, and the security warning about permission flattening.
+**Description**: Reference automation for scheduled refresh in two
+deployment shapes, both driving the same importer container: a Kubernetes
+CronJob manifest (shared volume for the artifact + state; rollout trigger
+for lightspeed-stack) and a podman-only Quadlet reference (`.container` +
+`.timer` systemd units, plain-cron fallback noted). Plus the admin guide
+covering credentials (Secret / podman secret; service-account
+recommendation), scheduling, staleness expectations, and the security
+warning about permission flattening.
 
 **Blocked by**: LCORE-???? (end-to-end importer command)
 
 **Acceptance criteria**:
 - Manifest applies cleanly on a stock OpenShift/k8s cluster
+- Quadlet units run the same refresh on a podman-only RHEL-family host
+  (systemd timer fires, artifact refreshed, restart documented)
 - Guide walks an admin from zero to scheduled refresh with the DB-file
-  contract (image variant referenced)
+  contract in both shapes (image variant referenced)
 
 **Agentic tool instruction**:
 

docs/design/byok-confluence-import/byok-confluence-import.md

@@ -56,8 +56,11 @@ unchanged pages).
   permission denials, and rate limiting (429 honoring `Retry-After`) are
   reported distinctly; a partial crawl never silently produces a truncated
   store.
-- **R9:** A reference Kubernetes CronJob manifest and admin guide document
-  the scheduled-refresh deployment (shared volume + rollout trigger).
+- **R9:** Reference automation and an admin guide document the
+  scheduled-refresh deployment in two shapes driving the same importer
+  container: a Kubernetes CronJob manifest (shared volume + rollout
+  trigger) and a podman-only Quadlet reference (`.container` + `.timer`
+  systemd units) for non-Kubernetes hosts.
 - **R10:** lightspeed-stack requires no code or config-schema changes; its
   BYOK guide documents the Confluence flow (spike Decision S5).
 
@@ -173,7 +176,7 @@ output:
 | R6  | Re-run, no changes: 0 body fetches, 0 re-embeds. Edit: page re-imported. Delete: gone after rebuild | e2e (mock) |
 | R7  | Missing/incomplete model fails preflight; artifact loads from a different absolute path | integration |
 | R8  | 401/403/429 produce distinct, actionable, non-zero outcomes | unit (fixtures) |
-| R9  | Reference CronJob applies cleanly; scheduled run refreshes the artifact | e2e (kind/CRC) or documented manual verification |
+| R9  | Reference CronJob applies cleanly; scheduled run refreshes the artifact; Quadlet timer does the same on a podman-only host | e2e (kind/CRC) or documented manual verification |
 | R10 | lightspeed-stack serves the artifact with existing `byok_rag` config | e2e |
 
 ## Aspect-specific concerns
@@ -201,10 +204,12 @@ multi-hour, operation at default limits.
 
 ### Rollout / deployment plan
 
-Admin-driven: deploy CronJob → first full crawl → point `byok_rag` at the
-artifact → restart. Refresh = CronJob rebuild + rollout trigger
-(documented `kubectl rollout restart` or operator-specific equivalent).
-Rollback = repoint to the previous versioned artifact and restart.
+Admin-driven: deploy the scheduler (k8s CronJob, or Quadlet systemd timer
+on podman-only hosts) → first full crawl → point `byok_rag` at the
+artifact → restart. Refresh = scheduled rebuild + restart trigger
+(documented `kubectl rollout restart`, `systemctl restart`, or
+operator-specific equivalent). Rollback = repoint to the previous
+versioned artifact and restart.
 
 ## Implementation Suggestions
 
@@ -219,6 +224,7 @@ Rollback = repoint to the previous versioned artifact and restart.
 | `scripts/import_confluence.py` (new) | One-shot orchestration: fetch → `DocumentProcessor` → optional `--output-image` |
 | `Containerfile` (modify) | Include the importer entrypoint in the tool image |
 | `examples/confluence-cronjob.yaml` (new) | Reference CronJob manifest |
+| `examples/confluence-import.container` + `.timer` (new) | Quadlet reference for podman-only hosts |
 | `docs/` (rag-content, new page) | Admin automation guide |
 | `docs/byok_guide.md` (lightspeed-stack, modify) | Confluence walkthrough, model-match + restart + permission warnings |
 | `tests/confluence/` (rag-content, new) | Unit tests on recorded Cloud/DC fixtures; integration test fixture-HTML → artifact |
@@ -267,6 +273,7 @@ env vars. No lightspeed-stack Pydantic changes (R10).
 | Date | Change | Reason |
 |------|--------|--------|
 | 2026-07-09 | Initial version | LCORE-2664 spike |
+| 2026-07-21 | R9 + rollout + key files: added podman/Quadlet reference alongside the k8s CronJob | PM review on spike PR (spike Decision S4 amended A→D) |
 
 ## Appendix A: PoC evidence summary