Manual sync mode can apply without a /sync request

Behavior#

In manual mode (spec.syncPolicy.automatic: false), convoy must apply only after a /sync request. But convoy makes the rollout decision before the manual-mode gate:

• A new render opens a Progressing rollout while the apply waits for /sync.
• A rollout in RolledBack applies the last healthy render with no /sync request. This apply also skips the cluster-wave gate.

Effect#

In manual mode, convoy can change the cluster without a /sync request.

Workaround#

Set spec.failurePolicy.rollback: Never on Releases that use manual mode.