fix: allow helm-mirror write-back with job tokens

Summary

Closes #452 (closed).

Allow Helm mirror dependency write-back through CI_JOB_TOKEN when GITLAB_TOKEN is absent or empty and no SSH key is configured. Preserve explicit personal-token and SSH authentication precedence in the shared Git helper.

Plan

1. Add nonempty job-token fallback to shared Git authentication and explain the required project push setting.
2. Cover credential selection, warning output, empty credentials, and real OCI/local-Git write-back.
3. Validate current-source CI and complete the guarded reviewer handoff.

Acceptance criteria

• A nonempty CI_JOB_TOKEN works when GITLAB_TOKEN is unset or empty.
• Explicit personal tokens and configured SSH keys keep their precedence.
• Job-token authentication warns about Allow Git push requests to the repository, its settings location, and the pipeline user's branch permissions.
• Credentials are not printed; the configured remote contains no token and the credential file is mode 0600.
• All 17 local Helm mirror tests pass, including eight new authentication cases, real verified-TLS OCI publishing, and disposable Git write-back using the actual authentication helper.
• Source/generated Markdown lint, rendered documentation review, CI YAML lint, final diff review, and current-main rebase pass.
• Full current-source pipeline succeeds; final Definition of Done and review handoff completed.

Behavior and verification

CI_JOB_TOKEN cannot inspect the project setting through the Projects API. The fallback therefore always logs an actionable prerequisite warning, not a claim that the setting was detected as disabled. It never changes project settings or turns a rejected write-back into success. Protected-branch rules and the existing same-project MR restriction remain unchanged.

The eight new authentication cases run actual Git credential lookup without network access. The full-component OCI test uses the actual job-token authentication helper, routing its HTTPS URL to disposable local Git with a fixture-only insteadOf rule. This proves the configured fallback integrates with write-back; it does not claim a real GitLab job-token push was performed. Two new fallback regressions fail against unchanged main.

Official references: job-token push prerequisites, job-token API access.

CI status

GitLab automatically started current-source pipeline 3008108310 at MR creation. It is running at source 874598ae5a158bf8b6a149f94ced542cc223c25a; no extra manual pipeline was dispatched. Two-pipeline capacity was rechecked before creating the MR. The branch remains draft without a reviewer until the complete required pipeline and final Definition of Done pass.

An event-driven read-only watcher resumes the remaining validation/handoff when CI settles, a required root check fails, the MR source changes, or a check errors. Local testing does not establish CI success.

Closes #452 (closed)

Rebased-head validation

The Docker Hub transport retry completed and the preceding source CI passed. Current main then added the archive-comparison repair, so I rebased onto it rather than treating the old result as validation of a new head. Published d79ba4a4; range-diff confirms the task patch is unchanged. All 17 Helm-mirror tests pass, including credential precedence/privacy, verified-TLS OCI publication and actual disposable Git write-back. The first local attempt lacked Skopeo; rerunning with the existing isolated fixture binary passed the complete suite. Final diff/whitespace are clean.

Started complete rebased-head CI after fresh access/assignment, default/development, complete prior lifecycle and global two-root checks. Keep draft with no reviewer until all required current-head checks and final DoD pass; local checks and the preceding successful pipeline do not replace that result.

Targeted ZAP transport retry

The required ZAP child failed because its spider could not read the unchanged external target http://burpbountylab.com/: Read timed out. Its report assertion then failed against the incomplete scan. No root job failed, and every other root bridge is terminal; this is not a Helm-mirror credential assertion failure.

Decision: retry only the failed ZAP bridge in the existing current-head root, preserving dependency ordering and the required scanner/report checks. No new work root, source change, scanner exemption or waived check was introduced. The targeted retry is pending, not successful validation. Keep draft/paused without a reviewer until full current-head CI and final DoD pass.

Inherited required ZAP fixture dependency

The targeted ZAP retry completed, but the remaining failure is no longer a transport timeout. Its scanner successfully crawls 15 URLs and publishes six findings; the required report assertion fails because the external target supplies no informational fixture. The assertion and uncontrolled external plan are identical on the verified default branch. The fully paginated connected-tree audit covers 62 pipelines; this is the remaining required failure, not a Helm-mirror credential assertion.

Opened the inherited fixture repair and related it to #452 (closed). Keep this MR draft and blocked on that repair; do not repeatedly retry the unchanged successful scan or weaken the informational/high-risk/JUnit assertions. Resume current-source validation and final DoD after the repair is actually merged and validated.

Related to #455 (closed)

Delivered dependency and rebased validation

The inherited ZAP repair !623 is merged and #455 (closed) is closed, satisfying that delivery dependency. Rebased onto delivered main d4dcc507 at 1bf6d687; all five task-scoped file bytes are unchanged and the delivered fixture correction is an ancestor.

All 17 Helm-mirror regressions pass, including the eight actual Git credential cases, verified-TLS OCI copying and full disposable matching-parent Git write-back through the real authentication helper. Missing local Skopeo prerequisites were resolved with signed-package tooling and its unmodified default trust policy in an isolated directory; temporary system package additions were removed. Exact-branch GitLab compilation is valid; existing duplicate-pipeline warnings remain visible. Final diff and whitespace checks pass.

Published with exact force-with-lease and CI skipped. The dependency is cleared, but fresh complete current-head CI/children/cleanup and final DoD remain required. Both permitted earlier work roots occupy capacity, so pause dispatch without creating a third root. Keep draft without reviewers; prior-source CI and local checks are not current-head CI acceptance. No production setting, credential precedence, required assertion or CI policy was changed.

Current-head targeted execution

The current-source Helm-mirror child passes all five jobs. Downloaded actual JUnit verifies all 17 cases with zero failures/errors/skips. This is real CI execution of the configured fixtures, not a claim that a live GitLab job-token push or project-setting change occurred.

The complete root lifecycle is still incomplete in the inspected 60-created-node/244-job snapshot; required work and owned cleanup remain running, pending or resource-waiting. That snapshot has no API read error or required failure. Current root status is running. Keep draft without reviewers until complete required CI/children/cleanup and final DoD pass. No new root, retry, credential change or waived assertion was introduced during final checks.

Complete current-head DoD

Complete current-head CI succeeds at unchanged 1bf6d687. Fully paginated recursive inspection, including API-triggered workflow/catalog downstreams, settles all 67 successful pipeline nodes and 262 jobs: 257 successful jobs and five unchanged declared allowed-failure checks. No required job is failed, skipped, unfinished or unread.

All six stop/cleanup jobs succeed. Actual traces verify Helm/ZAP release and namespace deletion, both Argo Application removals and successful Molecule destruction; the external review fixture is explicitly ephemeral. Freshly downloaded Helm-mirror JUnit verifies all 17 cases with zero failures/errors/skips, including all eight actual Git credential cases and verified-TLS OCI/disposable Git write-back. This does not claim a live GitLab job-token push or a project-setting change.

Fresh main fetch/fast-forward and rebase are no-ops. The complete five-file diff, documentation, whitespace and all paginated notes/discussions are reviewed; final DoD is complete. Decision: mark ready and use the guarded reviewer helper, which assigned xrow under the linked-work-item-author rule. No approval or merge was attempted. Keep #452 (closed) open in review until delivery; credential precedence, protected-branch rules and required scanner/assertion policy are unchanged.