1 unit Kubernetes deployment: automatic checks skipped

On Kubernetes, if an application with a single unit is refreshed, the automatic checks after `juju refresh` (

- that the deployed workload OCI image hash matches the hash pinned in the charm code
- that the refresh is compatible
- pre-refresh health checks & preparations

) are skipped.

This is because, on Kubernetes, it is not possible to prevent refresh of the highest number unit (https://canonical-charm-refresh.readthedocs-hosted.com/latest/juju-refresh/). And—for a single unit deployment—after the first unit refreshes, the application's refresh has completed (and rollback is not possible; only downgrade is possible).

Start with the Kubernetes single-unit behavior during `juju refresh` and read the linked canonical-charm-refresh documentation. Trace where the workload image hash, refresh compatibility, and pre-refresh health checks are skipped, then verify that the relevant checks run for a one-unit deployment without assuming rollback is available.

Written by the indexing model from the issue text.