distill: 48 cross-project best-practices from 2026-07 reflection sweep

Promotions from reflecting 21 projects' session logs (incl. agent-runtimes
122-log drain). Adds coverage across networking (eBPF VIP/VPN SNAT/VLAN
bridge/forward-auth preflight/ingress TLS), kubernetes (CSI hotplug/PodSecurity
debug/self-managed GitOps/runtime annotations), CI (dispatch tokens/runner
death/base image), git (CI-rebase/shallow reset/PR governance), python (async
session pool/httpx redirects/logging), TDD (AsyncMock/xfail lifecycle),
api-integration (SDK parse/token-scope 404/schema probing), plus docker,
scripting, debugging, security-architecture, secrets, react, octopus.

State: .distill-state.json refreshed with current HEADs + 5 newly-tracked projects.

octopus-process-templates.md

@@ -255,6 +255,11 @@ To demonstrate a full CI-to-deployed flow, set lifecycle phases to auto-deploy b
 7. **Process templates cannot reference the project's own Git repo** for scripts — use inline scripts or external URLs.
 8. **Test templates** by creating a test project that consumes them before sharing widely.
 
+## Deployment Freeze Gotchas
+
+- **Freeze recurrence is Daily/Weekly/Monthly only — no sub-daily granularity.** `RecurringSchedule.Type` accepts only `Daily`, `Weekly`, `Monthly`; `Cron`, `OnceDaily`, `Custom`, and `None` are rejected by validation. A short-cycle rolling freeze (e.g. a few minutes in every ten) cannot be expressed as a native recurring freeze. Fallback: a scheduled runbook that rewrites the freeze's `Start`/`End` every N minutes.
+- **Deployment freezes are instance-level, not space-scoped.** Use `/api/deploymentfreezes` — the space-scoped path 404s silently.
+
 ## References
 
 - OCL Syntax: https://octopus.com/docs/projects/version-control/ocl-file-format