feat!: realign operator with Paperclip's real config contract + fix app-boot blockers

[stubbi]

Summary

Realigns the operator with the Paperclip app's actual configuration contract (verified against paperclipai/paperclip@master), removes config the app never consumed, and fixes the bugs that prevented the app from actually booting on a stock cluster. Verified end-to-end on kind: the real Paperclip app boots to Ready with the realigned config.

Breaking change (feat!:). Existing CRs using spec.redis, spec.adapters.managedInference*, or spec.deployment.mode: open|single-tenant must be migrated before upgrade. See docs/UPGRADING.md.

Config realignment

• Deployment mode enum open|authenticated|single-tenant → local_trusted|authenticated (the only values the app accepts) + new spec.auth.disableSignUp for the former single-tenant intent + CEL rule (private exposure when local_trusted). Probe auto-selection updated.
• Bind: emit PAPERCLIP_BIND=custom + PAPERCLIP_BIND_HOST=0.0.0.0 instead of the legacy HOST.
• Remove dead Redis (spec.redis + StatefulSet/Service/PVC + NetworkPolicy + env): the app bundles no Redis client and reads no Redis env; it was an idle pod wired to nothing. (Planned to return once the app consumes it.)
• Remove fabricated managed-inference (spec.adapters.managedInference* / PAPERCLIP_MANAGED_*): these env vars don't exist in the app. Use spec.adapters.apiKeysSecretRef (ANTHROPIC_API_KEY/OPENAI_API_KEY); model discovery is automatic.
• Add AWS Secrets Manager vault: spec.secrets.provider + spec.secrets.aws → PAPERCLIP_SECRETS_PROVIDER / PAPERCLIP_SECRETS_AWS_* (creds via IRSA, no keys injected).
• Add E2B sandbox key: spec.adapters.e2b.apiKeySecretRef → E2B_API_KEY (the only sandbox provider with an env path; Modal/Cloudflare/SSH are UI-configured).
• Add app-native DB backup: spec.backup.appNative → PAPERCLIP_DB_BACKUP_*; spec.backup.schedule is now optional.

App-boot fixes (found via the full-boot e2e — each blocked the app on a stock cluster)

• Gateway API watch: Owns(&HTTPRoute{}) was unconditional, so without the gateway-api CRDs the controller never started its workers and reconciled nothing. Now watched only when the CRD is present.
• OTEL preload: NODE_OPTIONS=--import ./server/dist/instrumentation.js was forced always, crashing every container (ERR_MODULE_NOT_FOUND) on images without that file. Gated behind observability.metrics.enabled.
• gosu entrypoint vs restricted PSS: the image entrypoint drops root→node via gosu, which fails under runAsNonRoot/drop-ALL. The operator now execs node directly (keeping pod-0 heartbeat gating).
• Authenticated-mode hostname allowlist: always include the in-cluster Service DNS so the operator's own bootstrap (and in-cluster clients) pass the app's allowlist.

Docs / install

• New docs/deploy/runtime-configured-features.md (MCP stdio server, Modal/Cloudflare/SSH environments, first-admin) and docs/UPGRADING.md migration guide; README/api-reference/samples realigned.
• Release pipeline now publishes a version-pinned install.yaml asset (fixes the README kubectl apply 404; relates to how to access the container image? #61, which is otherwise resolved).

Test plan

• make fmt && make vet && make lint
• make test (unit + envtest integration)
• make test-e2e on kind: 4 of 4 Specs SUCCESS — real app boots to Ready (managed Postgres, authenticated mode), realigned env asserted, no Redis, feature env (AWS vault / E2B / app-native backup) rendered, clean teardown
• New unit tests for every builder change + conformance CEL cases

Known follow-ups (not blockers)

• App registry publishes no semver image tags (only latest/sha-*); operator forbids :latest, so pin a sha-* tag.
• Bootstrap CEO-promotion is blocked by the app's config-file-vs-env split (onboard --yes writes config.json as local_trusted; the CLI reads the file, not the env the server honors). Admin account creation works; documented in docs/deploy/runtime-configured-features.md.

🤖 Generated with Claude Code