Implement: Helm base chart for the reference deployment (#171)

[ealt]

Summary

Phase 13a: a Helm chart at reference/helm/eden/ that deploys the EDEN reference services on any conforming Kubernetes cluster (1.27+), parallel to the Compose stack. This PR ships the chart ported to the post-#128 opaque-id identity model, with the default being the single-experiment path that compose-smoke validates.

• Post-Disambiguate user-facing names from system-generated ids (experiments, workers, groups) #128 identity model. setup-experiment-helm.sh mints the opaque exp_* id + reserved admins/orchestrators groups + one wkr_* worker per service against the task-store-server (POST {"name": ...} → worker_id + one-time registration_token), mirroring the canonical Compose setup-experiment.sh. Each pod gets its minted --worker-id and a per-service identity Secret whose token an initContainer installs at the path the service's credential bootstrap reads (worker hosts: /var/lib/eden/credentials/<worker_id>.token; web-ui: .../<experiment_id>/<worker_id>.token), verified at startup via /whoami — no admin reissue. Three-phase bring-up (infra → task-store-server → mint identities → app tier) staged by two render gates (experiment.baseCommitSha, identity.<svc>.workerId+token).
• Lease-driven HA is opt-in (orchestrator.leaseMode.enabled, default false) and deferred behind Reconcile #128 opaque-id minting with #147's lease-mode orchestrator (multi-experiment smoke gap) #281; the default deploys no control plane, sets no EDEN_CONTROL_PLANE_URL, and runs one orchestrator.
• Bundled orchestrator change (Decision 9): --max-quiescent-iterations 0 "never exit on quiescence" sentinel (Kubernetes restartPolicy: Always); single-experiment mode honors 0 as a substrate override of the Audit deployment CLI flags for promotion to experiment-config fields #157 config-wins behavior.
• Reviewed to convergence over three codex:rescue rounds (record under docs/plans/review/eden-phase-13a-helm-base-chart/impl/).

Advances Phase 13a (first Kubernetes-substrate chunk). Spec ↔ impl: no spec change — the protocol is unchanged; only the deployment substrate is new. The one impl change (orchestrator quiescence sentinel) is a substrate accommodation, not a protocol change.

What this does NOT cover

• Lease-driven HA (multi-replica orchestrators + control plane). Wired as an opt-in toggle but deferred + unvalidated behind Reconcile #128 opaque-id minting with #147's lease-mode orchestrator (multi-experiment smoke gap) #281 (reconcile Disambiguate user-facing names from system-generated ids (experiments, workers, groups) #128 opaque-id minting with Backfill: compose-smoke-multi-experiment CI job (Phase 12c deferral) #147's lease-mode orchestrator self-registration). Re-enable once Reconcile #128 opaque-id minting with #147's lease-mode orchestrator (multi-experiment smoke gap) #281 lands. Only the single-experiment default is exercised by helm-smoke.
• helm-upgrade-smoke CI job (plan §6.3) — deferred to helm-upgrade-smoke CI job (Phase 13a §6.3 deferral) #284.
• Cross-service artifact serving on Kubernetes (needs RWX / external blob backend) — deferred to Cross-service artifact serving on Kubernetes (RWX / blob backend) #285.
• helm-lint/helm-smoke required-status bump — deferred to Bump helm-lint + helm-smoke to required status checks #286 (newly-added-smoke-job convention: bump after ~2 weeks clean on main).
• Kubernetes-native --mode subprocess + DooD worker hosts — 13a ships only --mode scripted; deferred to Kubernetes-native subprocess + DooD worker hosts #291.
• Subsequent Phase 13 substrate work (GPU executor Job 13b, managed Postgres 13c, S3/GCS 13d, Forgejo auth 13e) is pre-planned roadmap scope, not a gap.

Fresh-operator walkthrough

This PR changes operator-facing surfaces (the chart templates, setup-experiment-helm.sh, the web-ui --credential-dir flag).

• The fresh-operator walkthrough is the helm-smoke CI job: it spins up a kind cluster, builds + loads the image, runs setup-experiment-helm.sh against the fixture exactly as a fresh operator would, and asserts the integration end-state (≥3 variant.integrated, ≥9 task.completed, ≥3 ideation task.completed). The local equivalent is bash reference/helm/eden/ci-smoke.sh.
• Notes: A full local kind deploy was not run (kind not installed on the dev host); the operator path is validated by helm-smoke in CI. Locally validated: helm lint, helm template for both the single-experiment and lease-mode stacks (rendered manifests parse as valid Kubernetes objects), the schema fail-closed checks (empty image, half-set identity), and the per-service token-install paths against what each service's credential resolver reads. Watching helm-smoke through to green is the gating walkthrough for this PR.

Test plan

• python3 scripts/check-rename-discipline.py — clean
• python3 scripts/check-complexity.py — 0 blocking
• uv run ruff check . — clean
• uv run pyright — 0 errors
• markdownlint (all tracked md) — 0 errors
• shellcheck setup-experiment-helm.sh + ci-smoke.sh — clean
• helm lint reference/helm/eden -f reference/helm/eden/ci-values.yaml — passes
• helm template single-experiment + lease-mode → valid k8s; empty-image + half-set-identity correctly rejected
• uv run pytest -q — 2245 passed, 249 skipped; 1 failure is the known sandbox os.killpg EPERM artifact (test_ideator_subprocess), unrelated to this change
• helm-smoke CI job (the kind end-to-end) — gating; watching to green

Related issues

• Closes Phase 13a — Helm base chart for the reference deployment #171 — Phase 13a: base Helm chart for the reference services
• Refs Reconcile #128 opaque-id minting with #147's lease-mode orchestrator (multi-experiment smoke gap) #281 — lease-mode HA reconciliation (deferred; opt-in toggle wired)
• Refs helm-upgrade-smoke CI job (Phase 13a §6.3 deferral) #284 / Cross-service artifact serving on Kubernetes (RWX / blob backend) #285 / Bump helm-lint + helm-smoke to required status checks #286 / Kubernetes-native subprocess + DooD worker hosts #291 — deferred follow-ups enumerated above
• Triage: see docs/triage.md.

🤖 Generated with Claude Code