// Line 57 - assumes first container is validator
cs := jobPod.Status.ContainerStatuses[0]  // ❌ Breaks with sidecars!

// Line 82 - empty container name defaults to first container
logs, logErr := pod.GetPodLogs(ctx, d.clientset, d.namespace, jobPod.Name, "")  // ❌ Not explicit!

// Add helper function
func findContainerStatus(statuses []corev1.ContainerStatus, name string) (corev1.ContainerStatus, bool) {
    for _, cs := range statuses {
        if cs.Name == name {
            return cs, true
        }
    }
    return corev1.ContainerStatus{}, false
}

// Update ExtractResult
func (d *Deployer) ExtractResult(ctx context.Context) *ctrf.ValidatorResult {
    // ...
    
    // BEFORE: cs := jobPod.Status.ContainerStatuses[0]
    // AFTER:
    cs, found := findContainerStatus(jobPod.Status.ContainerStatuses, "validator")
    if !found {
        result.ExitCode = -1
        result.TerminationMsg = "container 'validator' not found (ADR-002 violation)"
        return result
    }
    
    // ...
    
    // BEFORE: logs, logErr := pod.GetPodLogs(ctx, d.clientset, d.namespace, jobPod.Name, "")
    // AFTER:
    logs, logErr := pod.GetPodLogs(ctx, d.clientset, d.namespace, jobPod.Name, "validator")
}

// ExtractResult reads the exit code, termination message, and stdout from the
// "validator" container in a completed validator pod.
//
// CONTRACT (ADR-002): The container name MUST be "validator". This is a frozen
// public contract to ensure sidecar-safety — ExtractResult will only read from
// the "validator" container, ignoring any sidecar containers that may be
// injected by external controllers (e.g., log streaming, result processing).
//
// This method must be called after WaitForCompletion returns, when the Job is
// in a terminal state (Complete or Failed).
func (d *Deployer) ExtractResult(ctx context.Context) *ctrf.ValidatorResult {