fix(workspace): ship Python backend in the image, not the ConfigMap (fixes #430 + Mission Control 404)

[imran31415]

Fixes #430. Also fixes the Mission Control /api/missioncontrol/queue 404 users see after updating.

Problem

The browser-config ConfigMap embedded the whole Python backend (server.py + memory/ skills/ adapters/ gateway.py mcp_* — ~992 KiB, 32 files) via {{ .Files.Get }}. As the code grew it crossed both 1 MiB limits:

• the rendered ConfigMap object → ~1086 KiB (> the 1 MiB ConfigMap cap), and
• the Helm release Secret (rendered manifest + bundled chart files) → ~1 MiB,

so helm upgrade began failing for every workspace:

Secret "sh.helm.release.v1.<ws>.vN" is invalid: data: Too long: may not be more than 1048576 bytes

That silently froze every workspace's ConfigMap-delivered server.py — self-serve/admin updates only ever patched the image, so a v1.41.1 image still ran a v1.40.1 server.py → no Mission Control → the 404. make ship/make deploy/self-serve reconcile were all blocked.

Fix — bake the backend into the image, drop it from the chart

• devlaptop/Dockerfile: COPY server.py + memory/ skills/ adapters/ (+ top-level mcp_*/gateway/seed_*/harness/…) into /opt/browser-src.
• start.sh: seed /tmp/browser + /home/dev/.claude-memory from /opt/browser-src (a cp -a tree copy) instead of unpacking flat /browser-config ConfigMap keys.
• Delete browser-configmap.yaml; remove its mount/volume/checksum from the Deployment. Code changes now roll the pod via the image tag.
• .helmignore the backend .py so Helm stops bundling it into the chart — this is what actually shrinks the release Secret. Packaged chart: ~1 MB → 64 KiB.

Consequence (deliberate)

Backend changes now ship via an image rebuild (a release), not a config-only make ship-config. Every release already rebuilds the image — and this also kills the recurring "image updated but backend stale" bug class (#240/#307/#319/#430): an image update now delivers backend code by construction.

Verification

• helm lint clean; 106 helm unittests green (2 updated for the new /opt/browser-src path); helm template renders with no browser-config ConfigMap/mount/volume.
• Local COPY+seed simulation: server, hypervisor_session, gateway, mcp_*, and the memory/skills/adapters packages all import cleanly, and server.py contains the api/missioncontrol route.
• Packaged chart shrank from ~1 MB to 64 KiB → release Secret comfortably under 1 MiB.
• CI's Docker Build Smoke Test builds the full amd64 image with the new COPY (final gate).

After merge

Cut a release; workspaces can helm upgrade again and self-serve/fleet updates deliver the current server.py — Mission Control appears and the 404 is gone.

🤖 Generated with Claude Code