fix(supervisor): reject an empty toleration value

An empty value after "=" parses as an exact match on a valueless taint,
which is legal but almost never what was meant. A templated value that
resolved empty produced a toleration that matched nothing, so the
supervisor started and every run pod stayed pending. The error names the
Exists form for anyone who did mean it.

Author: nicktrn

apps/supervisor/src/envUtil.test.ts

@@ -120,9 +120,15 @@ describe("Tolerations", () => {
     ]);
   });
 
-  it("should keep an empty value as an exact match for a valueless taint", () => {
-    expect(Tolerations.parse("dedicated=:NoSchedule")).toEqual([
-      { key: "dedicated", operator: "Equal", value: "", effect: "NoSchedule" },
+  it("should reject an empty value, and point at the Exists form instead", () => {
+    const result = Tolerations.safeParse("dedicated=:NoSchedule");
+    expect(result.success).toBe(false);
+    expect(result.error?.issues[0]?.message).toBe(
+      'Invalid toleration format (empty value): "dedicated=:NoSchedule". Drop the "=" to tolerate any value of "dedicated".'
+    );
+
+    expect(Tolerations.parse("dedicated:NoSchedule")).toEqual([
+      { key: "dedicated", operator: "Exists", effect: "NoSchedule" },
     ]);
   });
 

apps/supervisor/src/envUtil.ts

@@ -122,6 +122,14 @@ export const Tolerations = z.string().transform((val, ctx) => {
       }
 
       const value = keyValue.slice(eqIdx + 1).trim();
+      if (!value) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: `Invalid toleration format (empty value): "${entry}". Drop the "=" to tolerate any value of "${key}".`,
+        });
+        return z.NEVER;
+      }
+
       if (!isLabelValue(value)) {
         ctx.addIssue({
           code: z.ZodIssueCode.custom,