feat(busbar-150): 1.5.0 boots - auth chain empty, writable config dir for its signing key

Verified locally against the real image before spending another box: busbar
1.5.0 comes up and listens.

Two 1.5.0 requirements the 1.4.1 manifest never had to meet:

  auth: chain: []   The 1.4.1 config on this board has NO auth block, and 1.4.1
                    permitted that. 1.5.0 refuses to run silently in that state.
                    chain: [] is busbar's own documented dev setting ('the open
                    front door: development only, loud startup warning') and it
                    is the only one that keeps the rows comparable - with a real
                    auth chain 1.5.0 would verify a signed key per request while
                    1.4.1 verified nothing, and the delta would be measuring
                    authentication rather than the gateway. Not a favour either:
                    busbar logs an ERROR and two WARNs about it every boot.

  writable /work    1.5.0 generates and persists an ed25519 signing key next to
                    the config on first boot. /etc/busbar is read-only in the
                    image, so the config now mounts at /work with BUSBAR_CONFIG
                    and BUSBAR_PROVIDERS pointing there.

The stricter manifest schema earned itself again on this change: it rejected the
env map I first wrote ('invalid type: map, expected a sequence') at load rather
than letting a silently-ignored field reach a box.

Author: MattJackson

gateways/busbar-150/config.gen.yaml.tmpl

@@ -53,3 +53,17 @@ models:
   gpt-4o-mini-bedrock:
     provider: mock-bedrock
     max_concurrent: 8000
+
+# AUTH OFF, TO MATCH WHAT 1.4.1 ACTUALLY RAN.
+#
+# The 1.4.1 config on this board has no auth block at all, and 1.4.1 permitted that. 1.5.0 refuses to
+# boot silently in that state - it hardened - so the posture has to be declared rather than implied.
+# `chain: []` is busbar's own documented dev setting ("the open front door: development only, loud
+# startup warning"), and it is the ONLY setting that keeps the two rows comparable: with a real auth
+# chain, 1.5.0 would verify a signed key on every request while 1.4.1 verified nothing, and the delta
+# would be measuring authentication rather than the gateway.
+#
+# It is not a favour to 1.5.0 either - busbar logs an ERROR and two WARNs about it on every boot, and
+# the board's rule is the bare minimum required to run.
+auth:
+  chain: []

gateways/busbar-150/definition.json

@@ -32,18 +32,26 @@
   "lang": "Rust",
   "launch": {
     "args": [],
+    "env": [
+      [
+        "BUSBAR_CONFIG",
+        "/work/config.yaml"
+      ],
+      [
+        "BUSBAR_PROVIDERS",
+        "/work/providers.yaml"
+      ]
+    ],
     "image": "getbusbar/busbar:1.5.0",
     "kind": "docker",
     "mounts": [
       {
-        "container_path": "/etc/busbar/config.yaml",
-        "host_path": "config.gen.yaml",
-        "read_only": true
+        "container_path": "/work/config.yaml",
+        "host_path": "config.gen.yaml"
       },
       {
-        "container_path": "/etc/busbar/providers.yaml",
-        "host_path": "providers.gen.yaml",
-        "read_only": true
+        "container_path": "/work/providers.yaml",
+        "host_path": "providers.gen.yaml"
       }
     ]
   },