[AIP-5398/5400/5407] Add LAS lifecycle, readiness, and deployment coverage

[pmitra77]

Summary

Adds LAS lifecycle and readiness regression coverage for AIP-5398 and AIP-5400, plus installer-managed LAS secrets and egress controls for AIP-5407.

AIP-5398 — LAS lifecycle tests

• Verify LAS release identity and generated values, including configured image and Secret references.
• Cover initial install, unchanged reconciliation, controller restart without a redundant upgrade, and an updated desired configuration.
• Assert that foreign-owned releases are rejected and installation failures leave the AIService not Ready with an actionable status.
• Extend the recovery test fake to model install failures.

AIP-5400 — health and status regressions

• Cover recovery when the LAS Service endpoint becomes usable and the API health check succeeds.
• Verify the AIPlatform Ready status recovers when the current AIService becomes Ready.
• Preserve coverage for workload and endpoint readiness transitions.

AIP-5407 — deployment configuration and egress

• Add a deployment helper that manages deterministic, deployment-owned LAS auth, PostgreSQL, and Redis Secrets; applies Secret references to the AIPlatform; validates ownership/schema; avoids unnecessary writes when credentials are unchanged; and handles optional API-key removal and partial retries.
• Reconcile the deployment-owned LAS API/queue NetworkPolicy from normalized IP/CIDR allowlists, preserve internal and DNS traffic, reject invalid or catch-all CIDRs, and remove only the deployment-owned policy when the allowlist is omitted.
• Update the k0s installer and ECR credential refresh flow to stream registry credentials through stdin and use server-side apply, avoiding client-side last-applied credential copies.
• Warn when queue autoscaling is enabled but the resource metrics API is unavailable.
• Add helper and installer regression coverage, CI wiring, and installation documentation.

Validation

• Formatted the changed Go files with gofmt.
• git diff --check passed.
• Tests were not run; they are planned for a later step.
• Real-cluster checks for secret rotation, NetworkPolicy enforcement, and queue HPA metrics remain outstanding.

Scope note

AIP-5402 caller-route tests are not included. They depend on a working AIP-5401 SLIM-to-LAS route and its agreed request/response contract.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T01:18:34.322994Z	435b596	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 435b5965c2

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[pmitra77]

Scope correction after review: the branch now contains only the AIP-5398 LAS lifecycle tests and AIP-5400 readiness/status regressions. The unrelated AIP-5407 installer/deployment changes have been removed. The PR title/body currently still reflect the old scope; I don’t have an edit-PR connector here, so please treat this note and the current changed-files list as authoritative. Tests remain intentionally unrun per the plan to test later.