self tests

rig/ctrl/lib/config.sh

@@ -21,9 +21,14 @@
 # NODES and AUDIT are deliberately NOT here: they are properties of the chosen
 # ctrl/k8s/kind-config*.yaml.tpl and are read back out of it below, so there is
 # one place that decides the shape of the cluster rather than two that can drift.
+#
+# REGISTRY_PORT and MANIFESTS_DIR were missing here while ctrl/.env set them, so
+# the caller's env silently LOST to the file for those two — the one precedence
+# rule this header states. Both are now listed; the other twelve are unchanged.
 CONFIG_OVERRIDABLE="PROFILE CLUSTER K8S_VERSION KIND_CONFIG ADDONS
                     REGISTRY_MODE INGRESS_MODE DNS_MODE TILT_PORT
-                    SOURCE ARCH DEPS_SOURCE HTTP_PORT HTTPS_PORT"
+                    SOURCE ARCH DEPS_SOURCE HTTP_PORT HTTPS_PORT
+                    REGISTRY_PORT MANIFESTS_DIR"
 
 # The containing folder's name, reduced to something kind accepts as a cluster
 # name (a DNS label: lowercase alphanumerics and dashes). Run from ctrl/, so the
@@ -93,6 +98,12 @@ load_config() {
     TILT_PORT="${TILT_PORT:-$((base + 2))}"
     REGISTRY_PORT="${REGISTRY_PORT:-$((base + 3))}"
 
+    # Where the workload's manifests live, repo-root relative. Defaulted here so
+    # it is always resolved rather than sometimes-set: it is the seam that lets
+    # the real manifests be versioned away from the installer, and a consumer
+    # should not have to know whether anyone filled it in. See k8s/README.md.
+    MANIFESTS_DIR="${MANIFESTS_DIR:-ctrl/k8s/overlays/dev}"
+
     # Profiles name a k8s minor (v1_36); versions.env holds the pinned digest.
     local var="NODE_IMAGE_${K8S_VERSION}"
     NODE_IMAGE="${!var:-}"