The env var name was a misnomer — ConfigClient resolves both config and
secrets, not just secrets. The struct field was already config_namespace.
Legacy SecretManager keeps the old var; this forces migration to
ConfigClient for new code.
The root token + unseal keys were written to a single fixed
`~/.local/share/harmony/openbao/unseal-keys.json`, so deploying a second
OpenBao instance (different namespace/release) overwrote the first's keys —
after which the first could never be unsealed. Key the file by
namespace+release (`unseal-keys-<ns>-<release>.json`); `cached_root_token`
now takes the `OpenbaoInstance` to read the right one.
`console::style(emoji).green()/.yellow()/.red()/.blue()` embedded raw ANSI
escapes in the message string. `console` force-emits them off its own TTY
detection, which disagrees with the tracing writer, so they leaked as literal
`\x1b[..m` garbage around the emoji. Emit plain emojis — the glyph already
conveys status and the tracing fmt layer still colours the level.
`Maestro::initialize` (hence `topology.ensure_ready()`) ran before `init`'s
`--list` / confirmation short-circuits, so merely listing a binary's scores —
or declining to run them — still prepared the topology (cert-manager install,
etc.). Build the maestro unprepared and call `prepare_topology()` only once we
commit to interpreting. Expose `Maestro::prepare_topology`; add tests proving
`--list` skips prep while the run path triggers it.
Swap env_logger for tracing_subscriber (its fmt bridges the framework's
log:: deploy-progress output) and route the install banner + step logs
through tracing::info! — no raw println.
fleet_staging_install now deploys OpenBao (co-located in fleet-staging,
cert-manager TLS at secrets-stg.<base>), configures it (fleet-deployer
read policy), and seeds the operator's FleetDeploySecrets so the operator
can be upgraded alone via 'harmony-fleet-deploy --from-tag'. Behavior of
the existing bring-up is unchanged.
Credential-TOML construction moved out of the example into
OperatorCredentials::zitadel_jwt (deploy crate) so all callers share it.
New openbao::cached_root_token() lets the seed reuse the root token setup
already cached. Seeding mirrors the harmony_sso port-forward pattern.
