fix: let CKS Q103's setup try a second Pod for its Falco alert

Q103 failed to seed once in an audit of six hosts at a time: a minute
passed without a Falco alert naming the Pod. When that happens, the
setup now replaces the Pod - a new container, which Falco's container
plugin looks up afresh - and waits one minute more before it gives up.

Record the final audit in README.md and CHANGELOG.md: CKS 110/110 on
v1.37, Q103 passing alone and with the other seven VM tasks six at a
time, and CKA Q132, CKAD Q1 and CKS Q60, Q61 and Q64 passing on the
images rebuilt with hexdump and xxd.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HDuDkQHyHPvYZQAE1z5CF2

CHANGELOG.md

@@ -72,6 +72,9 @@ Every entry names the commit it came in.
 - CKS Q4 gave 3 of its 12 points untouched: its token check took any Pod of the Deployment, and
   an untouched Deployment's Pods run as `default`, with a token mounted. It now takes a Pod that
   runs as `<deployment>-sa`.
+- CKS Q103 failed to seed once, six hosts at a time: a minute passed without a Falco alert naming
+  the Pod. Its setup now tries a new Pod - a container Falco's container plugin looks up afresh -
+  before it gives up.
 - Building a host image for a kind image not pulled yet: podman's pull progress was read as the
   etcd image's name.
 - A solution or lesson step that prints binary data (an etcd value) no longer stops the audit.

README.md

@@ -208,15 +208,19 @@ cluster from v1.36.4 to v1.37.1, worker included.
 their own, score nothing when graded untouched 45 seconds after seeding, and reach full marks when
 their scripted solution is run on the host as `candidate`.
 
-**CKS, as audited on 2026-10-19** (v1.37, Ubuntu hosts): 109 of 110 tasks seed cleanly on a host
-of their own, score nothing when graded untouched 45 seconds after seeding, and reach full marks
-when their scripted solution is run on the host as `candidate`. Q103, a Falco task on a VM host,
-failed to seed once — Falco raised no alert naming the Pod within a minute — and is still to be
-audited again. The 26 objectives are the curriculum's own (`cks/curriculum.py`), each with notes,
-commands, traps and the documentation the exam allows — which, per the Linux Foundation's list
-read on 2026-10-12, is the Kubernetes docs and blog plus Falco, bom, etcd, the NGINX Ingress
+**CKS, as audited on 2026-10-19** (v1.37, Ubuntu hosts): all 110 tasks seed cleanly on a host of
+their own, score nothing when graded untouched 45 seconds after seeding, and reach full marks when
+their scripted solution is run on the host as `candidate`. Q103, a Falco task on a VM host, failed
+to seed once that day — a minute passed without an alert naming the Pod — and passed on
+2026-10-20, alone and with the other seven VM tasks six at a time; its setup now tries a new Pod
+before it gives up. The 26 objectives are the curriculum's own (`cks/curriculum.py`), each with
+notes, commands, traps and the documentation the exam allows — which, per the Linux Foundation's
+list read on 2026-10-12, is the Kubernetes docs and blog plus Falco, bom, etcd, the NGINX Ingress
 Controller, Cilium and Istio. Trivy's and AppArmor's own documentation are not on it.
 
+**On 2026-10-20**, after `hexdump` and `xxd` were added to the hosts, CKA Q132 (the upgrade from
+v1.36), CKAD Q1 and CKS Q60, Q61 and Q64 passed again on the rebuilt images.
+
 ### A task
 
 ```python

cks/bank_vm.py

@@ -57,8 +57,18 @@ for d in frontend worker cache reports; do
   $K -n %{ns} create deploy $d --image=busybox:1.36 -- sh -c "$cmd" >/dev/null
 done
 for d in frontend worker cache reports; do $K -n %{ns} rollout status deploy $d --timeout=240s >/dev/null || exit 1; done
-pod=$($K -n %{ns} get pod -l app=%{bad} -o jsonpath='{.items[0].metadata.name}'); echo "%{ns}/$pod" > "$PRIV/q103"
-falco_up && alerted "Sensitive file opened.*k8s_pod_name=$pod " 60 || { echo "Falco raised no alert for the Pod" >&2; exit 1; }
+# Once, in an audit of 19 tasks six hosts at a time, a minute passed without an alert naming the
+# Pod. A new Pod is a new container, which Falco's container plugin looks up afresh: the setup
+# tries one before it gives up.
+named=
+for try in 1 2; do
+  pod=$($K -n %{ns} get pod -l app=%{bad} -o jsonpath='{.items[0].metadata.name}'); echo "%{ns}/$pod" > "$PRIV/q103"
+  falco_up && alerted "Sensitive file opened.*k8s_pod_name=$pod " 60 && { named=1; break; }
+  [ $try = 2 ] && break
+  $K -n %{ns} delete pod "$pod" --grace-period=1 >/dev/null 2>&1
+  $K -n %{ns} wait --for=condition=Ready pod -l app=%{bad} --timeout=240s >/dev/null || exit 1
+done
+[ -n "$named" ] || { echo "Falco raised no alert for the Pod" >&2; exit 1; }
 """,
  "checks": [
   C("pod.txt names the Pod that reads /etc/shadow", 3, r"""eq "$(tr -d ' \n\r' < "$WS/q103/pod.txt" 2>/dev/null)" "$(cat "$PRIV/q103")" """),