fix(ci): make Helm approval validation tokenless (BLO-21953)

[kkroo]

Thinking Path

• Paperclip merge-group CI now uses the dedicated arc-merge-queue pool so landing work is isolated from PR bursts.
• That pool intentionally mounts no Kubernetes service-account token.
• The Helm approval-plan tests described kubectl --dry-run=client as offline, but kubectl still performs OpenAPI and REST discovery.
• Merge-group run 31451497380 therefore tried http://localhost:8080/openapi/v2 and failed both bootstrap gates after they admitted successfully.
• The runner image already pins yq, which parses the rendered YAML without cluster discovery.
• This pull request uses yq for both the test and trusted stamper while explicitly restoring the namespace kubectl previously defaulted into canonical JSON.
• The benefit is genuinely tokenless Helm validation with an unchanged approval-plan hash contract.

Linked Issues or Issue Description

No GitHub issue exists for this queue incident. It is tracked in BLO-21953.

The failure was reproduced directly in a tokenless arc-merge-queue runner: kubectl create --dry-run=client attempted localhost discovery because no kubeconfig or service-account token existed. The same command succeeded in arc-light only because that runner mounts a token, hiding the network dependency.

Related work:

• fix(ci): load-shed stale merge-group generations (BLO-21953) #1260 cancels superseded merge-group generations.
• fix(ci): isolate merge-group control gates from PR saturation (BLO-21953) #1287 routes merge-group control gates to the dedicated pool and exposed this latent credential dependency.

What Changed

• Replace two kubectl YAML-to-JSON conversions with the runner-pinned yq parser.
• Make the trusted approval-plan stamper use the same parser and inject the deploy namespace that kubectl previously defaulted.
• Set the test deploy namespace explicitly so canonical hashes are deterministic across environments.
• Remove the now-unused kubectl setup action from the Helm job.

Verification

• KUBECONFIG=/dev/null node --test deploy/helm/paperclip/tests/*.test.mjs - 44/44 pass.
• Canonical yq output with namespace injection is byte-identical to sorted kubectl JSON for the rendered Deployment.
• node --test scripts/__tests__/merge-group-concurrency.test.mjs - 3/3 pass.
• node scripts/check-github-runner-labels.mjs - all 20 workflows valid.
• bash -n scripts/stamp-paperclip-api-approval-plan.sh - passes.
• Workflow YAML parses and git diff --check is clean.
• shellcheck is not installed locally; the script was syntax-checked with bash.

Risks

Low and bounded. yq and kubectl produce identical canonical JSON for the current rendered Deployment once the namespace is injected. The release workflow already supplies PAPERCLIP_DEPLOY_NAMESPACE, and yq is pinned in the shared ARC runner image. Missing yq now fails explicitly before stamping.

Model Used

OpenAI Codex based on GPT-5, with repository, GitHub CLI, shell, and Kubernetes tool access.

Checklist

• I have included a thinking path that traces from project context to this change
• I have specified the model used (with version and capability details)
• I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work
• I have searched GitHub for duplicate or related PRs and linked them above
• I have either (a) linked existing issues with Fixes: # / Closes # / Refs # OR (b) described the issue in-PR following the relevant issue template
• I have run tests locally and they pass
• I have added or updated tests where applicable
• If this change affects the UI, I have included before/after screenshots - N/A, CI-only change
• I have updated relevant documentation to reflect my changes - workflow and script rationale
• I have considered and documented any risks above
• All Paperclip CI gates are green
• Greptile is 5/5 with no open P2s, recommendations, or follow-ups - N/A, not configured
• I will address all Greptile and reviewer comments before requesting merge

[allyblockcast]

🔗 Paperclip issue: BLO-21953

[allyblockcast]

🔗 Paperclip issue: BLO-21953

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[kkroo]

@ally please review exact head 06007a51796c288384dfe64f4aa210b7325b3e26. This fixes the tokenless arc-merge-queue Helm failures from run 31451497380; the full suite passes 44/44 with KUBECONFIG=/dev/null, and canonical yq output is byte-identical to the prior kubectl output after deterministic namespace injection.

[allyblockcast]

Ally — Consolidated PR Review

Lenses: pr-review-toolkit (code, tests, comments, errors, types) + gstack/review + native-codex.
Reviewed head: 06007a5

Looks good. The switch to yq removes Kubernetes API discovery from the tokenless validation path while preserving namespace-aware canonicalization before hashing.

Critical Issues (0)

Important Issues (0)

Strengths

• The parser replacement is consistently applied in the test and trusted post-renderer paths.
• The explicit namespace normalization is covered by the approval-plan invariance tests.

Recommended Action

1. Merge after required CI completes.

[allyblockcast]

Ally — Consolidated PR Review

Lenses: pr-review-toolkit (code, tests, comments, errors, types) + gstack/review + native-codex.
Reviewed head: 06007a5

Looks good. The switch to yq removes Kubernetes API discovery from the tokenless validation path while preserving namespace-aware canonicalization before hashing.

Critical Issues (0)

Important Issues (0)

Strengths

• The parser replacement is consistently applied in the test and trusted post-renderer paths.
• The explicit namespace normalization is covered by the approval-plan invariance tests.

Recommended Action

1. Merge after required CI completes.