fix(setup): seed the REST site record and fix the worker DB target (release/v2.0)

[shayan1995]

Cherry-pick of #3284 (7b35d52) onto release/v2.0, following the same process as #3182.

Bind the site-agent to a REST-created site and fix the workflow-worker DB target. Two defects left a fresh site with an empty nicocli site list despite a healthy, handshaked site-agent: the site UUID was minted without any REST database record behind it (the bootstrap Job's POST /v1/site creates only the Site CR + OTP), and the workflow workers missed the nico-pg-cluster consolidation (#3081), failing every DB activity with SQLSTATE 42P01 so no site could ever leave Pending.

Changes

• setup.sh: resolve the site UUID instead of blindly minting — explicit NICO_SITE_UUID (bind to a pre-existing site), else the prior install's CLUSTER_ID (site-agent ConfigMap), else adopt an existing REST site with the same name, else mint. Then seed the REST DB directly (same record shape as forged's per-env site.sql): a default infrastructure_provider for the org plus a Pending site row named after siteName, with the v2 networking capabilities (native_networking, network_security_group, flow) enabled and the status_detail row the REST create handler writes. All inserts idempotent (WHERE NOT EXISTS); waits up to 120 s for the REST migrations. IdP-agnostic — no API token needed. The bootstrap Job's existing POST /v1/site flow is untouched and runs after the DB row exists, under the same UUID.
• setup.sh: inject workflow-worker DB values at install time via the existing REST creds temp file — nico-rest-workflow now targets nico-pg-cluster/nico_rest as nico-rest.nico with the db-creds secret, aligned with nico-rest-api.
• setup.sh: delete a site-registration secret bound to a stale UUID so rebinding CLUSTER_ID re-bootstraps; input validation (UUID format, site-name/org charset) before SQL interpolation; quoting-agnostic siteName parsing.
• Docs (quick-start.md, helm-prereqs/README.md, configurability.md): NICO_SITE_UUID resolution behavior documented consistently.

Related Issues

N/A

Type of Change

Fix - Bug fixes

Breaking Changes

None.

Testing

Manual end-to-end validation on dev6

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 1825f7e3-6791-4859-8db5-faff64a8aeb0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pull-request-3340.docs.buildwithfern.com/infra-controller

[github-actions]

🔐 TruffleHog Secret Scan

✅ No secrets or credentials found!

Your code has been scanned for 700+ types of secrets and credentials. All clear! 🎉

🔗 View scan details

_{🕐 Last updated: 2026-07-09 23:19:33 UTC | Commit: ea486b6}

[github-actions]

🔍 Container Scan Summary

Service	Total	Critical	High	Medium	Low	Other
boot-artifacts-aarch64	3	0	0	3	0	0
boot-artifacts-x86_64	3	0	0	3	0	0
forge-admin-cli-x86_64	271	13	34	91	7	126
machine-validation-runner	800	37	234	291	43	195
machine_validation	800	37	234	291	43	195
machine_validation-aarch64	800	37	234	291	43	195
nvmetal-carbide	800	37	234	291	43	195
TOTAL	3477	161	970	1261	179	906

Per-CVE detail lives in the per-service grype-* artifacts (JSON + SARIF). Severity counts only — no CVE IDs published here.