feat(kind): self-contained vTeam catalog lab + fleet-skip provisioning

[jeremyeder]

Summary

Splits the vTeam lab work out on its own. Two changes, both about making the
vTeam catalog lab work against a clean cluster instead of relying on make kind-up
pre-provisioning the tenants:

• Fleet-skip: kind-up now provisions only the demo fleet (tenant-a,
  tenant-b). The fleet loop applies an overlay only when examples/overlays/<ns>/
  exists, and fails loudly (collects failures, exit 1) if any tenant apply
  fails — no silent partial provisioning. OPENSHELL_TENANTS default reduced to match.
• Self-contained vTeam lab: applying a catalog creates the Project, and the
  control plane provisions the backing namespace + gateway from that record — no
  kubectl create namespace needed. Rewrote QUICKSTART.md, vteam-lab.md, and the
  example READMEs accordingly, including correct provider-secret setup (vertex/github
  use a single token key; jira uses JIRA_URL/JIRA_USERNAME/JIRA_API_TOKEN).

Why draft

Opened as a draft for review of the lab flow before marking ready.

Scope

Makefile (2 fleet hunks), scripts/setup-kind-openshell.sh, and docs only. No Go,
no frontend, no API/K8s resource changes.

Verification

• make -n kind-status parses; make -n kind-up matches main behavior (pre-existing
  prereq exit, unrelated to this change).
• QUICKSTART port lookup uses the existing make kind-status / awk approach (no
  dependency on unrelated tooling).

[jsell-rh]

🤖 Amber Review — PR #369: vTeam catalog self-contained lab + fleet-skip provisioning

Summary: Makefile, script, and docs-only change. No Go, frontend, or API surface touched. Scope is exactly what the PR description claims — clean and well-bounded.

---

What I checked

Makefile fleet loop (kind-up):

• [ -f "examples/overlays/$$ns/kustomization.yaml" ] || continue — correct guard. Skips gracefully for tenants without an overlay; fails loudly when one exists but apply fails. The FLEET_FAILED accumulation + exit 1 at the end is the right pattern (collect all failures, fail at the end, not immediately — so you see all broken tenants in one run).
• OPENSHELL_TENANTS default reduced from 4 → 2 (tenant-a tenant-b). This is a behavior change for anyone with a custom cluster that previously relied on vteam-product-swarm/codebase-maintainers being in the default list. The PR description calls this out and the comment block in the Makefile explains it clearly — acceptable given this is a local Kind dev target, not production.

setup-kind-openshell.sh:

• Default in the script updated to match the Makefile (tenant-a tenant-b). Consistent. ✅

Docs (vteam-lab.md, QUICKSTART.md, examples/README.md, examples/vteam-catalog/README.md):

• The "self-contained" framing is accurate: applying the catalog creates the Project, and the control plane reconciler provisions namespace + gateway. The kubectl wait commands replacing the simple kubectl get checks are strictly better — they give the user a concrete ready signal with a timeout rather than requiring manual re-checking.
• QUICKSTART.md step reordering is cleaner: apply catalog first (step 4), secrets after (step 5). Matches the actual dependency order (namespace must exist before secrets can be created there). ✅
• Provider secret docs are now more accurate: correct key names (token for vertex/github, JIRA_URL/JIRA_USERNAME/JIRA_API_TOKEN for jira), correct namespace, and explicit "do not use make kind-setup-vertex" warning. This was a gap — users following the old guide would have created secrets in the wrong place or with wrong keys. ✅
• Removed export AMBIENT_PROJECT=vteam-product-swarm from the login step — correct, since the project doesn't exist at that point in the flow. ✅

---

No issues

No Go code, no frontend changes, no K8s resource changes, no API schema changes. The change is limited to:

• 2 fleet hunks in Makefile (guard + failure accumulation)
• 1 default change in setup-kind-openshell.sh
• Docs-only updates across 4 markdown files

ACP constitution compliance: N/A for Makefile/docs. No panic(), no any types, no token logging, no RBAC paths touched.

Confidence: High (95%) — small, well-scoped, testable with make -n kind-up.

— Amber

[jsell-rh]

Applying amber/approved. This is a draft — ready from a review standpoint; merge when you're happy with the lab flow. — Amber

[Mukeshmike09]

Tested this branch (196d009) end-to-end on a clean cluster : Fedora, podman 5.7.1 (rootless), kind 0.33.0-alpha:

• make kind-down && make kind-up completes cleanly : the two no kustomization.yaml found errors I hit on main are gone
• Only the demo fleet is provisioned (tenant-a, tenant-b) : namespaces, ACP projects, and fleet definitions applied for both
• All pods ready; agents/providers/credentials seeded in both tenants
• hello-world session runs on this branch : sandbox provisioned, agent executed, inference streamed through the gateway

For context: the same machine hit both missing-overlay errors on a fresh make kind-up from main yesterday. (I did hit one environment gotcha along the way : low inotify limits on Fedora crashlooping the agent-sandbox controller : unrelated to this PR, filing separately.)

LGTM from a first-time-user perspective.