rig major updates

rig/ctrl/addons/metallb.sh

@@ -3,7 +3,7 @@
 # The pool is derived from the kind Docker network at install time.
 # Notes: docs/notes/addons.md
 set -euo pipefail
-cd "$(dirname "$0")/.."
+cd "${RIG_CTRL:-$(dirname "$0")/..}"
 
 source ./lib/config.sh
 load_config
@@ -46,7 +46,9 @@ echo "  kind network $subnet → pool ${pool_start}-${pool_end}"
 if $K get deployment -n metallb-system controller >/dev/null 2>&1; then
     echo "  already installed"
 else
-    $K apply -f "https://raw.githubusercontent.com/metallb/metallb/${METALLB_VERSION}/config/manifests/metallb-native.yaml"
+    # The pinned manifest, verified on disk — never a URL applied directly.
+    manifest=$(bash ./deps.sh manifest METALLB)
+    $K apply -f "$manifest"
 fi
 
 # `rollout status`, not `kubectl wait`: wait errors out while the pod doesn't exist yet.