fix(apps): semaphore SEMAPHORE_PORT — shadow kubelet service-link injection

With the config PVC now writable (fsGroup), semaphore got past config write and
pinged its PostgreSQL successfully, then crashed on:
  panic: value of field 'Port' is not valid: tcp://<svcIP>:3000

Because the Service is named `semaphore`, the kubelet injects the Docker-link-style
SEMAPHORE_PORT=tcp://<clusterIP>:3000, which collides with Semaphore's OWN
SEMAPHORE_PORT (its HTTP listen port). Add an explicit SEMAPHORE_PORT=":3000" env
entry — user-defined env takes precedence over service-link vars — pinning the
listen port back to :3000 (matches containerPort/Service). Uses the existing env
field; only apps/semaphore.yaml changes, all others byte-identical.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

apps/semaphore.yaml

@@ -116,6 +116,8 @@ spec:
             secretKeyRef:
               name: semaphore-bootstrap
               key: access-key-encryption
+        - name: SEMAPHORE_PORT
+          value: :3000
         volumeMounts:
         - name: config
           mountPath: /etc/semaphore

catalog/semaphore.yaml

@@ -66,6 +66,13 @@ env:
       secretKeyRef:
         name: semaphore-bootstrap
         key: access-key-encryption
+  # Because the Service is named `semaphore`, the kubelet injects a Docker-link-style
+  # SEMAPHORE_PORT=tcp://<svcIP>:3000 env var, which COLLIDES with Semaphore's OWN SEMAPHORE_PORT
+  # (its HTTP listen port) and crashes config validation ("field 'Port' is not valid: tcp://..."). An
+  # explicit env entry shadows the injected one (the kubelet gives user-defined env precedence over
+  # service links), pinning the listen port back to :3000 (matches containerPort/Service).
+  - name: SEMAPHORE_PORT
+    value: ":3000"
 # The semaphoreui/semaphore image runs as the non-root user UID 1001 / GID 0 (tini -> server-wrapper),
 # and on boot the wrapper writes its generated config.json into the config dir. A mounted Longhorn PVC
 # is root:root, so UID 1001 cannot write it -> the pod panics ("permission denied"). fsGroup=1001 makes