jenkins: mkdir DOCKER_CONFIG in cgLogin Mode B, harden django smoke test

Two Copilot findings from the seventh pass on PR #330:

- cgLogin Mode B: mkdir -p "$DOCKER_CONFIG" eagerly even though we
  don't write creds. cgSign/cgVerify always bind-mount it into a
  sibling cosign container with `docker run -v "$DOCKER_CONFIG":...`;
  if the dir doesn't exist the host docker daemon auto-creates it as
  root, and a later switch to Mode A would then fail when chainctl
  (uid 1000 inside the controller) tries to write a fresh config
  there. Mode A/C already mkdir, only Mode B was missing it.
- python312-pip-django/app.py: add an explicit django.setup() and a
  real (in-memory sqlite) DATABASES default. contrib.auth and
  contrib.contenttypes declare models and can trigger AppRegistryNot
  Ready / DB-config errors during app loading. The smoke test happens
  to pass today because the hello view never touches the registry,
  but the configuration is invalid per Django's contract — verified
  the fixed app round-trips the Test-stage Client().get('/') call.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ericsmalling

jenkins/apps/python312-pip-django/app.py

@@ -5,6 +5,7 @@
 import os
 import platform
 import sys
+import django
 from django.conf import settings
 from django.core.management import execute_from_command_line
 from django.http import HttpResponse
@@ -17,10 +18,25 @@
     ALLOWED_HOSTS=["*"],
     INSTALLED_APPS=["django.contrib.contenttypes", "django.contrib.auth"],
     MIDDLEWARE=[],
-    DATABASES={},
+    # In-memory SQLite — contrib.contenttypes and contrib.auth declare models
+    # and need a `default` DB or app loading bombs out. We never touch the DB
+    # at request time (the hello view returns a constant), so :memory: is fine.
+    DATABASES={
+        "default": {
+            "ENGINE": "django.db.backends.sqlite3",
+            "NAME": ":memory:",
+        },
+    },
     USE_TZ=True,
 )
 
+# Initialise the app registry. `execute_from_command_line` (runserver path)
+# calls this internally, but the Test stage imports this module directly and
+# invokes django.test.Client without going through that codepath — without an
+# explicit setup() call the app registry stays unpopulated and the test fails
+# with AppRegistryNotReady the moment contrib.auth's signals fire.
+django.setup()
+
 
 def hello(request):
     import django

jenkins/shared-libraries/cg-images/vars/cgLogin.groovy

@@ -58,14 +58,25 @@ EOF
         echo "cgLogin: configured Harbor admin auth for localhost / localhost:80 (Mode C)."
       '''
     } else {
-      // Mode B: anonymous everywhere, nothing to write. PUSH_REGISTRY is
-      // typically ttl.sh/<prefix> but setup.sh accepts any non-localhost
-      // value, so log the actual target rather than hardcoding ttl.sh.
-      // Pass pushRegistry through the sh-step environment rather than
-      // interpolating into the script body — defends against shell
+      // Mode B: anonymous everywhere, no creds to write. We still mkdir
+      // $DOCKER_CONFIG eagerly so it exists with uid-1000 ownership before
+      // cgSign/cgVerify bind-mount it into a sibling cosign container — if
+      // the dir doesn't exist when `docker run -v "$DOCKER_CONFIG":...` runs,
+      // the host docker daemon auto-creates it as root, and a later switch
+      // to Mode A would then fail when chainctl (uid 1000 inside the
+      // controller) tries to write a fresh docker config there.
+      //
+      // PUSH_REGISTRY is typically ttl.sh/<prefix> but setup.sh accepts any
+      // non-localhost value, so log the actual target rather than hardcoding
+      // ttl.sh. Pass pushRegistry through the sh-step environment rather
+      // than interpolating into the script body — defends against shell
       // metacharacters in a user-supplied PUSH_REGISTRY value.
       withEnv(["PUSH_DISPLAY=${pushRegistry ?: '(unset)'}"]) {
-        sh 'echo "cgLogin: Harbor mode, anonymous pulls + pushes to $PUSH_DISPLAY (Mode B)."'
+        sh '''
+          set -eu
+          mkdir -p "$DOCKER_CONFIG"
+          echo "cgLogin: Harbor mode, anonymous pulls + pushes to $PUSH_DISPLAY (Mode B)."
+        '''
       }
     }
     return