chore(charts): productionize sam-mesh chart - #302

The hardcoded five-entry list came from the e2e test fixtures and was already
stale for every service under development/examples/ except calc-mcp. Expose it
as bootstrap.nodeServices, defaulting to ["*"].

Two workarounds it forced are now gone: the sam-admin binding that enumerated
per-node kind ServiceAccounts (local-node-sa never existed), and the local
allow policies in everything-mcp's node config.

One Gateway and one HTTPRoute behind gateway.enabled: the cloud's 8 exact
control-plane paths, a separately-gated dev /admin rule, and the console under
gateway.consolePath shaped exactly like the cloud deployment — the bare prefix
302s to <prefix>/ and a URLRewrite filter strips it before the console.
URLRewrite is Extended conformance, so the provider must support it.

listeners, hostnames, addresses and annotations pass through to the Gateway API
objects verbatim, so TLS, static addresses and provider annotations are all
expressible instead of hardcoded. gateway.className has no default and is
required when enabled: the class is provider-specific, so a wrong default is
worse than a clear error.

Dex is an independent component; bundling it coupled the chart to one dev
IdP's config shape. The chart now ships no identity provider:
controlPlane.oidcIssuer loses its dex default and must be set, and the kind
lane deploys its own throwaway Dex from development/kind/dex.yaml instead.

run.sh now fronts the mesh with cloud-provider-kind: the control plane and
console share one gateway address, Dex gets its own, and the router is reached
at its node IP — no NodePorts, no extraPortMappings. Dex is deployed from
dex.yaml in two passes, since its issuer and the console callback URL are the
gateway addresses that only exist once the gateways do; the console is
restarted after the final control-plane rollout because it reads the issuer
from /info once, at startup.

The local node enrolls with a bootstrap token over the gateway, the way a real
external node joins. The cluster shrinks to two sam-node workers; add labelled
workers to kind-config.yaml to host more examples at once. make kind-down
delegates to run.sh so cloud-provider-kind and its envoy containers are torn
down in dependency order.

router.externalAddrs: node containers resolve sam-router per-network via
--add-host, so the relay test's isolated network works only while the
announced multiaddr carries that name; a node-IP announcement is unroutable
from there.

bootstrap.nodeServices: policy.bats' negative path proves the control plane
denies an ungranted service, which only works while sam:role:node has a finite
list. The chart default is now ["*"], so the lane declares the grants it tests.

The kind guide now matches the gateway lane: LoadBalancer addresses from
cloud-provider-kind, the console under /console on the control plane's
address, Dex outside the chart, and a bootstrap-token local node. The
use-case docs pick up the two-node default cluster.

The unbounded mcp>=1.0.0 pulled mcp 2.0.0, which dropped mcp.server.fastmcp,
so the container crashlooped on import. calc-mcp already pins <2.0.0.

runAsNonRoot + RuntimeDefault seccomp at pod level, no privilege
escalation and all capabilities dropped per container. The curl
init/bootstrap containers pin runAsUser 100 because the image's USER is
non-numeric, which runAsNonRoot can't verify. Postgres is left alone:
its entrypoint still runs as root and steps down itself.

Each sam image gains image.tag, falling back to global.imageTag.

Pinning a new controlPlane.adminToken or db password on upgrade only
updated the Secret; the pods kept the old env values until a manual
restart. A checksum/secrets pod annotation forces the rollout. The db
statefulset is left out: postgres keeps the password initdb stored in
the PVC, so restarting it on a values change fixes nothing.

The Role allowed get/create/delete/patch/update on all secrets in the
namespace, including the admin token and db password. The job only
server-side-applies the router-token secret: get/patch are now pinned to
it via resourceNames, create stays unscoped (admission cannot match a
name on create), and delete/update are dropped.

The libp2p peer ID derives from /data/router.key; on emptyDir every
reschedule minted a new identity, forcing re-enrollment and leaving the
old peer registered until its lease expired. A volumeClaimTemplate keeps
it stable, matching .github/k8s/sam-router-template.yaml.

volumeClaimTemplates are immutable: existing installs must delete the
router StatefulSet before upgrading (the PVC is created fresh either way).

Without a readiness probe the db Service routed to postgres while initdb
or crash recovery was still running. PGDATA is deliberately not moved to
a subdirectory: existing PVCs are initialized at the volume root and a
new PGDATA would shadow their data.

…workload

The router only exposed nodeSelector; the other workloads had nothing,
so the chart could not target dedicated or tainted node pools.

They were the only containers without resources, which blocks scheduling
in namespaces whose ResourceQuota requires them. Hardcoded small values:
the containers only poll /info and POST a couple of requests.

One suite per template covering the load-bearing logic: numeric
runAsUser pins, bootstrap RBAC scoping, secret checksum rollout,
hostPort/externalAddrs address derivation, gateway routing toggles, the
router PVC and OIDC mode, scheduling passthroughs and external postgres.

Run with make helm-test; the target installs the helm-unittest plugin on
first use. Suites that assert the checksum/secrets annotation also load
templates/secrets.yaml, or the include cannot resolve.

Runs make helm-lint and make helm-test (which installs the
helm-unittest plugin on first use); helm ships on the ubuntu runners.
Path-filtered to charts/ so it stays out of unrelated PRs.

The lane reuses the sam-wi-test kind cluster across runs, so upgrading
over a release from before the router volumeClaimTemplates change fails
with 'updates to statefulset spec ... are forbidden'. On upgrade failure
delete the StatefulSets (PVCs survive) and retry. Fresh clusters, as on
hosted CI, never take the retry path.

…storageClass

The default RollingUpdate surges a replacement pod before freeing the old
pod's hostPort, so on nodes where every schedulable node already runs a
replica the rollout deadlocks (FailedScheduling: no free ports). Seen on
the reused e2e kind cluster: 2 replicas, 2 workers, hostPort 8080.

… such flag

Server-side apply falls back to update when the object exists, so patch
alone is not always enough; still pinned to the router-token secret via
resourceNames.