jenkins/iac: fix doc inaccuracies about bootstrap flow + jenkins_issuer_url

Three doc/comment fixes all rooted in describing setup.sh's UIDP path
incorrectly:

- README "Usage" said setup.sh writes the identity UIDP into ../.env
  as CHAINGUARD_IDENTITY and that a docker compose restart jenkins is
  required afterward. Neither is true. setup.sh writes the UIDP to
  ../shared-libraries/cg-images/IDENTITY (a one-line file); cgLogin
  reads it on each pipeline build from the bind-mounted shared-libraries
  path, so no controller restart is needed.

- outputs.tf identity_uidp description had the same misclaim about
  ../.env; fixed to reference the IDENTITY file path.

- README jenkins_issuer_url default disagreed with variables.tf. TF
  default is "https://localhost:8080/oidc" (the Chainguard provider
  validator requires HTTPS); README said "http://". Aligned to https
  and added a note that JCasC sets JenkinsLocationConfiguration.url
  to https://localhost:8080/ so the emitted `iss` matches, even
  though the local Jenkins listens on plain HTTP.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ericsmalling

jenkins/iac/README.md

@@ -13,9 +13,8 @@ The two are mutually exclusive. `claim_match` supports subject patterns but requ
 
 This module is driven by [../setup.sh](../setup.sh), not run by hand. The bootstrap flow is:
 
-1. `docker compose up -d --build` — Jenkins starts and exposes its JWKS at `http://localhost:8080/oidc/jwks`.
-2. `./setup.sh` — fetches that JWKS into `iac/jenkins-jwks.json`, runs `terraform apply`, captures the output `identity_uidp`, and writes it into `../.env` as `CHAINGUARD_IDENTITY=<uidp>`.
-3. `docker compose restart jenkins` — picks up the new env var so pipelines have access to it.
+1. `./setup.sh` — brings Jenkins up via `docker compose`, waits for `http://localhost:8080/oidc/jwks` to respond, fetches that JWKS into `iac/jenkins-jwks.json`, runs `terraform apply`, captures the output `identity_uidp`, and writes it to `../shared-libraries/cg-images/IDENTITY` (a single line, just the UIDP).
+2. Jenkins picks up the identity at pipeline-build time. The shared library `cgLogin()` reads the IDENTITY file directly from the bind-mounted filesystem path on every build — no controller restart is needed.
 
 Manual `terraform apply` works too (useful for debugging or org changes), but you must populate `jenkins-jwks.json` first.
 
@@ -24,7 +23,7 @@ Manual `terraform apply` works too (useful for debugging or org changes), but yo
 | Name | Default | What it controls |
 |------|---------|------------------|
 | `chainguard_group_name` | *(required, no default)* | The parent group the identity lives under and the rolebinding's scope. setup.sh passes this via `-var` from `.env`'s `CHAINGUARD_ORG`. |
-| `jenkins_issuer_url` | `http://localhost:8080/oidc` | Must exactly match the `iss` claim Jenkins puts on its tokens. The `oidc-provider` plugin uses `<JENKINS_URL>/oidc` by default. |
+| `jenkins_issuer_url` | `https://localhost:8080/oidc` | Must exactly match the `iss` claim Jenkins puts on its tokens. The `oidc-provider` plugin uses `<JENKINS_URL>/oidc`. HTTPS is required by the Chainguard Terraform provider's validator even though the local Jenkins listens on plain HTTP — the URL is never fetched (the `static` block does offline JWKS verification), so the scheme is purely a claim-match string. The JCasC config (`jenkins/casc/jenkins.yaml`) sets `unsafe.jenkins.JenkinsLocationConfiguration.url` to `https://localhost:8080/` so Jenkins emits `iss=https://localhost:8080/oidc` to match. |
 | `jenkins_subject` | `jenkins-cgimages-puller` | Must exactly match the `sub` claim. Configured on the JCasC OIDC credential. |
 
 ## Reused conventions

jenkins/iac/outputs.tf

@@ -1,4 +1,4 @@
 output "identity_uidp" {
-  description = "UIDP of the Chainguard assumed identity. setup.sh writes this into ../.env as CHAINGUARD_IDENTITY."
+  description = "UIDP of the Chainguard assumed identity. setup.sh writes this single-line value to ../shared-libraries/cg-images/IDENTITY, which cgLogin reads from the bind-mounted shared-libraries path on each pipeline build."
   value       = chainguard_identity.jenkins_puller.id
 }