feat(story,runs,impulse,cel,config): request manifest metadata and wire secret artifacts, reorganize engram execution and artifact plumbing

[lanycrost]

request manifest metadata and wire secret artifacts, reorganize engram execution and artifact plumbing

• extend StepRun API/CRDs with manifest request/response fields, regenerated deepcopy, and loop bound config
• upgrade step executor/DAG to compute manifest specs, resolve loop inputs safely, and add unit coverage
• introduce secret artifact builder and plumb resolver/controller changes for Engram, Impulse, Story, and hybrid runs
• align operator config, webhooks, and manager manifests with new knobs; refresh go.mod/sum and workflow glue

---

Note

Introduces StepRun manifest metadata and secret artifacts, refactors controllers/webhooks/config for hybrid and executeStory flows, enhances CEL and tracing, and updates CRDs, indexing, and tests.

• API/CRDs:
  • Add StepRun.spec.requestedManifest and status.manifest/manifestWarnings; regenerate deepcopies.
  • Tighten StoryRun/StepRun status validations; StorySpec XValidations; default automountServiceAccountToken=true.
• Execution & Controllers:
  • Compute manifest specs in DAG/StepExecutor; safe loop input resolution; implement executeStory (sync/async) and sub-StoryRun wiring.
  • Hybrid fanout: derive downstream gRPC targets; pass via StepRun.spec.downstreamTargets and job env; create Services for Impulse/streaming Engrams.
  • Realtime/batch engram refactors (env, storage, TLS, service accounts); add RealtimeEngramReconciler and naming/with merge utils.
• Secrets & Storage:
  • New secretutil to build env/volumes/envFrom from template schemas; plumb through Engram/Impulse/Story/StepRun pods.
  • Operator defaults for S3 storage applied in resolver.
• Config/Manager:
  • Event-driven OperatorConfig manager (flags, initial load, telemetry toggles); expanded controller knobs; kustomize arg patches.
• Webhooks:
  • Default retry policies; validate sizes/graphs/executeStory refs; enforce monotonic observedGeneration; StepRun downstream target checks.
• CEL:
  • Add len() supporting manifest length; sanitize hyphenated step ids; tracing hooks.
• Indexing/RBAC:
  • New field indexes (spec.engramRef.key, story step refs); extend RBAC verbs.
• Ops/Deps/Tests:
  • Update CRD YAMLs/manifests; go.mod/sum bumps; numerous unit tests added.

^{Written by Cursor Bugbot for commit 2eec6f8. This will update automatically on new commits. Configure here.}