infra: bake jq fixes into NR JSON source (apply.sh + Terraform read same clean files)

[mastermanas805]

Summary

F's apply.sh in the infra repo patched 3 schema gaps at apply time via jq. Terraform reads the same JSON but wouldn't run the adapter, so the source JSON drifted from one applier to the other. This bakes the fixes into the source so apply.sh + Terraform consume identical clean structures.

Fixes baked:

1. Dashboards (infra/newrelic/dashboards/*.json): "accountIds": [0] → "accountIds": ["${NEW_RELIC_ACCOUNT_ID}"] across all 4 dashboards (28 total occurrences). Both apply.sh and Terraform substitute the real account ID before the API call.
2. Alerts (infra/newrelic/alerts/*.json): drop "type": "NRQL" — NerdGraph rejects it on NrqlConditionStaticInput; the mutation name encodes the type.
3. Alert policy (NEW: infra/newrelic/policies/instant-api.json): describes the umbrella policy (name: "instant-api alerts", incidentPreference: "PER_CONDITION_AND_TARGET"). Each alert in alerts/ gains "policyName": "instant-api alerts" linking back.

Coordination

apply.sh already handles the new shape defensively — no companion infra PR needed:

• prepare_dashboard uses walk(... has("accountIds") then .accountIds = [$account] ...) — rewrites .accountIds regardless of previous value (was [0], now ["${...}"], end result [number] either way).
• apply_alert already does del(.type) — a no-op when the field is absent.
• ensure_policy find-or-creates inline by POLICY_NAME env (default "instant-api alerts" — matches our policy file). Note: apply.sh hardcodes incidentPreference: "PER_CONDITION" in the create-branch while the policy file specifies PER_CONDITION_AND_TARGET. On existing accounts the find-branch wins so no drift; brand-new accounts will get the apply.sh value. Worth aligning in a follow-up infra PR but not blocking.

Tests

New: infra/newrelic/tests/bake_test.sh — 31 assertions:

• All 4 dashboards parse, no accountIds: [0] residue, token count matches nrqlQueries count per file
• All 4 alerts parse, no type field, policyName set to "instant-api alerts"
• policies/instant-api.json parses + has correct name + incidentPreference
• Cross-reference: every alert's policyName matches the policy file's name

Run: bash infra/newrelic/tests/bake_test.sh → 31 passed, 0 failed.

Test plan

• bash infra/newrelic/tests/bake_test.sh exits 0
• find infra/newrelic -name '*.json' -exec jq empty {} \; passes
• Spot-apply against staging NR account via existing apply.sh (defensive — exercises the unchanged jq adapter path); expect identical dashboard/alert output as pre-bake
• (follow-up infra PR, optional) Align apply.sh's hardcoded incidentPreference: "PER_CONDITION" with the policy file's PER_CONDITION_AND_TARGET

No Go code, k8s, or dashboard changes. JSON + README + test script only.

Generated with Claude Code