feat: add Redis Sentinel and TLS support in TrueForge

[thesujai]

Summary

feat: add Redis Sentinel and TLS support in TrueForge

Closes AGE-2071

Checklist

• I have read the contributing guidelines
• pnpm build, pnpm test, pnpm typecheck, pnpm lint:ci, and pnpm format:check pass locally
• Tests added/updated where it makes sense
• No hand-edits to generated code (packages/trueforge-sdk, python/trueforge_sdk, .github/fern/openapi/openapi.json, docs/openapi.json) — fork PRs omit SDK regen; maintainers regenerate after merge
• Docs / .env.example updated if configuration or behavior changed

---

Note

Medium Risk
Changes how every peered replica connects to Redis and how Helm injects Redis config; misconfiguration or Sentinel/TLS edge cases could block startup or break executor peering until fixed.

Overview
Distributed TrueForge can now connect to Redis via URL, host/port + auth, Redis Sentinel, and optional TLS/mTLS, instead of relying on a single REDIS_URL with a localhost default.

The server reads a broader REDIS_* env surface (host, port, DB, credentials, TLS material, Sentinel nodes/master/auth). connectRedis chooses Sentinel vs URL vs host mode, applies shared TLS socket options, loads PEM from paths or inline text, and rebuilds Sentinel clients on connect failure (except auth errors). Request-reply and event streaming use a shared RedisPeerClient type; Sentinel reuses one client for pub/sub (no duplicate() subscriber), with shutdown adjusted accordingly.

The Helm chart maps expanded externalRedis (url/host/auth/tls/sentinel) into those env vars, adds render-time validation (bundled vs external mutual exclusion, required fields), and documents upgrade-friendly externalRedis.enabled behavior. .env.example and chart README/NOTES are updated to match.

^{Reviewed by Cursor Bugbot for commit 49bd3b1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 49bd3b1

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@truefoundry/trueforge	Minor
@truefoundry/trueforge-core	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0c9ae4b. Configure here.}