apps: re-enable semaphore — both crashloop root causes fixed

Restores the four semaphore resources a peer temp-disabled in 0abadd3 to unblock
the apps Kustomization while the crashloop was diagnosed. Both root causes are now
fixed and verified against the live image:
  1. permission-denied writing /etc/semaphore/config.json (non-root UID 1001 vs
     root-owned Longhorn PVC) -> podSecurityContext.fsGroup=1001 (schema 1.3.0);
     verified the pod got past config write and successfully pinged its PostgreSQL.
  2. config panic on SEMAPHORE_PORT=tcp://<svcIP>:3000 (kubelet Docker-link
     injection for the same-named Service colliding with Semaphore's listen port)
     -> explicit SEMAPHORE_PORT=":3000" env shadowing the service-link var.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

apps/kustomization.yaml

@@ -21,15 +21,19 @@ resources:
   - nextcloud-db.yaml                      # CNPG PostgreSQL Cluster (ns nextcloud-db) — first CNPG-DB app
   - nextcloud-db-app.sops.yaml             # SOPS: CNPG owner credentials (basic-auth) for initdb
   - nextcloud-bootstrap-secret.sops.yaml   # SOPS: break-glass admin + mirrored db-password (ns nextcloud)
-  # TEMP-DISABLED (WS-APPS follow-up): semaphore crashloops because the semaphoreui/semaphore image
-  # falls through to its INTERACTIVE setup wizard (env vars didn't yield a non-interactive config)
-  # and panics on `open /etc/semaphore/config.json: permission denied`. It needs a proper config
-  # model (a mounted config.json / the right entrypoint + non-root writable config dir), not the
-  # env-only pattern. Re-enable once fixed. Files retained: catalog/semaphore.yaml, apps/semaphore*.
-  # - semaphore.yaml
-  # - semaphore-db.yaml
-  # - semaphore-db-app.sops.yaml
-  # - semaphore-bootstrap-secret.sops.yaml
+  # RE-ENABLED: the two crashloop root causes are now fixed (both verified against the live image).
+  # (1) permission-denied writing /etc/semaphore/config.json — the image runs as non-root UID 1001;
+  #     fixed by podSecurityContext.fsGroup=1001 (schema 1.3.0) so the mounted Longhorn PVC is
+  #     group-writable (verified: the pod got past config write and successfully pinged the DB).
+  # (2) config panic "field 'Port' is not valid: tcp://<svcIP>:3000" — the kubelet injects a
+  #     Docker-link SEMAPHORE_PORT for the same-named Service, colliding with Semaphore's own listen
+  #     port; fixed by an explicit SEMAPHORE_PORT=":3000" env that shadows the service-link var.
+  # The env-driven config IS non-interactive (the wizard text is the wrapper echoing while auto-
+  # answering from env). OIDC remains deferred (break-glass local admin), same as gitea/nextcloud.
+  - semaphore.yaml
+  - semaphore-db.yaml                      # CNPG PostgreSQL Cluster (ns semaphore-db) — second CNPG-DB app
+  - semaphore-db-app.sops.yaml             # SOPS: CNPG owner credentials (basic-auth) for initdb
+  - semaphore-bootstrap-secret.sops.yaml   # SOPS: break-glass admin + mirrored db-password + access-key-encryption (ns semaphore)
 # Gitea's headless-install env + break-glass admin postStart hook are now first-class in the
 # ServiceDefinition (catalog/gitea.yaml env/lifecycle, schema >=1.2.0) and rendered inline into
 # apps/gitea.yaml, so the former gitea-bootstrap-patch.yaml strategic-merge patch is retired.