rig updates

rig/ctrl/lib/config.sh

@@ -7,7 +7,7 @@
 #
 #   built-in defaults      below; fill only what nothing else set
 #   ctrl/versions.env      pinned toolchain + image digests   (committed)
-#   ctrl/env.d/<profile>   cluster shape — OPTIONAL, examples ship as *.env.example
+#   ctrl/env.d/<profile>   addons, registry — OPTIONAL, examples ship as *.env.example
 #   ctrl/.env              machine-local values and secrets   (gitignored)
 #   the caller's env       `make cluster up PROFILE=<name>`   (always wins)
 #
@@ -19,9 +19,8 @@
 
 # Values a user can reasonably override per-invocation. Anything set in the
 # environment when load_config runs is restored after the files are read.
-# NODES and AUDIT are deliberately NOT here: they are properties of the chosen
-# ctrl/k8s/kind-config*.yaml.tpl and are read back out of it below, so there is
-# one place that decides the shape of the cluster rather than two that can drift.
+# NODES is deliberately NOT here: it is read back out of the kind config below,
+# so the file is the one place that decides it.
 #
 # REGISTRY_PORT and MANIFESTS_DIR were missing here while ctrl/.env set them, so
 # the caller's env silently LOST to the file for those two — the one precedence
@@ -136,32 +135,18 @@ load_config() {
         exit 1
     fi
 
-    # The cluster's shape is a file in ctrl/k8s/, named by the profile. Adding a
-    # shape is adding a file; there is no dispatcher to edit.
-    #
-    # A host that needs its own shape — extra port mappings, more nodes — passes
-    # an absolute path instead, and rig renders it exactly like one of its own:
-    # ${CLUSTER} and ${NODE_IMAGE} are substituted either way. The shape stays in
-    # the host's tree, because what a host's cluster needs is the host's business;
-    # rig only knows how to build whatever it is handed.
-    KIND_CONFIG="${KIND_CONFIG:-kind-config.yaml.tpl}"
-    case "$KIND_CONFIG" in
-        /*) KIND_CONFIG_PATH="$KIND_CONFIG";          KIND_CONFIG_SHOWN="$KIND_CONFIG" ;;
-        *)  KIND_CONFIG_PATH="./k8s/${KIND_CONFIG}";  KIND_CONFIG_SHOWN="ctrl/k8s/${KIND_CONFIG}" ;;
-    esac
-    if [ ! -f "$KIND_CONFIG_PATH" ]; then
-        echo "no such cluster shape: ${KIND_CONFIG_SHOWN}" >&2
-        echo "rig's own: $(ls k8s/kind-config*.yaml.tpl 2>/dev/null | xargs -n1 basename | tr '\n' ' ')" >&2
-        echo "or pass an absolute path to a shape of your own" >&2
+    # The cluster is one file: k8s/kind-config.yaml.tpl. To change it, edit it.
+    # KIND_CONFIG is only "use this file instead", for a project that builds its
+    # own cluster through rig (a path relative to ctrl/, or absolute).
+    KIND_CONFIG="${KIND_CONFIG:-./k8s/kind-config.yaml.tpl}"
+    if [ ! -f "$KIND_CONFIG" ]; then
+        echo "no kind config at KIND_CONFIG=${KIND_CONFIG}" >&2
         exit 1
     fi
 
-    # Read the shape back out of the YAML rather than trusting a profile to
-    # restate it. check.sh sizes the memory warning on NODES, and cluster.sh
-    # prints AUDIT before spending minutes building something that cannot be
-    # changed afterwards — both would mislead if the numbers drifted.
-    NODES=$(grep -c '^  - role:' "$KIND_CONFIG_PATH")
-    if grep -q 'audit-policy-file' "$KIND_CONFIG_PATH"; then AUDIT=on; else AUDIT=off; fi
+    # Read the node count back out of the file rather than restating it:
+    # check.sh and the memory tool size their budget on NODES.
+    NODES=$(grep -c '^  - role:' "$KIND_CONFIG")
 
     # What one node costs, measured rather than guessed. On 2026-09-11 a minimal
     # control-plane node ran at 620 MiB idle and ~728 MiB with a small mock, plus
@@ -175,7 +160,7 @@ load_config() {
     NODE_MB=800
 }
 
-# Render a cluster shape to stdout. sed rather than envsubst: envsubst is
+# Render the kind config to stdout. sed rather than envsubst: envsubst is
 # gettext-base, absent from a minimal Debian, and Docker is meant to be the only
 # prerequisite. The variable list is explicit so a template cannot quietly start
 # depending on something the caller does not set.
@@ -188,7 +173,7 @@ render_kind_config() {
         -e "s|\${NODE_IMAGE}|${NODE_IMAGE}|g" \
         -e "s|\${HTTP_PORT}|${HTTP_PORT}|g" \
         -e "s|\${HOST_WORKDIR}|${host_workdir}|g" \
-        "$KIND_CONFIG_PATH"
+        "$KIND_CONFIG"
 }
 
 _config_restore() {