Proof: python3 test/ntfy_manifest_test.py; kubectl kustomize deploy/k8s/overlays/hetzner-single-node.
Assumptions: ntfy starts as an internal ClusterIP platform utility at http://ntfy.utility.svc.cluster.local; public or Tailscale exposure requires a later authenticated ingress decision.
Still fake: No public ntfy URL, auth policy, iOS subscription, webhook ingress, or durable ntfy cache volume is configured yet.
