refactor(router): gate init container first-run setup on explicit marker file

[mrsimpson]

Follow-up to #65.

Summary

• Init containers run on every pod start, not once per PVC. Today the script infers "is this the first run?" from filesystem side-effects ([ ! -d /home/opencode/.config/opencode ], [ ! -d /workspace/.git ]).
• Those checks are per-phase, so a partial failure (config seed succeeds, git clone fails with ENOSPC) leaves the PVC in a half-initialized state — one phase sees "done", the other sees "needs init", and no retry heals it.
• Replace with an explicit marker at /home/opencode/.opencode-init.v1, written last under set -e. Any failure before the marker leaves FIRST_RUN=1 on the next start and the whole first-run block re-runs.
• Versioned suffix (.v1) gives a clean migration path: bump to .v2 to force re-init on existing PVCs when seeded defaults change in a breaking way.

Drive-by fix

The no-repoUrl path (git init + git commit --allow-empty) used to run unguarded on every pod start, adding a fresh empty commit per restart. Now gated on FIRST_RUN.

What stays "every-start"

• Skill asset sync, init-scripts/*.sh runs (intentional — covers image updates)
• Router plugin list ensure (covers resumed pods written before the plugin was added)
• Stale .gitconfig.lock cleanup
• GitHub credential setup (token may rotate)
• Dirty-aware fetch/checkout from fix(router): skip git fetch/checkout when /workspace has uncommitted changes #65

Considered alternatives

• Per-phase markers (.opencode-init.config.v1, .opencode-init.git.v1): more bookkeeping, marginal benefit — set -e already aborts on the first failure so phases never partially complete in a single run.
• PVC annotation + downward API: source of truth on the control plane, but the router would have to stamp the annotation onto each new pod spec — real complexity for the same end behavior.
• Separate Job for first-run setup: cleanest architectural fix but a larger rework. Worth doing later if init-time setup grows.

Test plan

• bun test src/pod-manager.test.ts — 69 pass (2 new tests covering marker placement and no-repoUrl guard)
• bun run typecheck — clean
• Manual: start a fresh session pod, confirm /home/opencode/.opencode-init.v1 exists after init; restart the pod, confirm init container completes quickly without re-seeding .config/opencode

🤖 Generated with Claude Code

[mrsimpson]

Closing — reviewing this with fresh eyes uncovered a migration bug and a weak value proposition.

Migration bug: every existing session pod would crashloop on its next restart after this shipped. With no marker present, FIRST_RUN=1 fires, and:

1. cp -r /etc/opencode-defaults/. /home/opencode/.config/opencode/ silently clobbers user-modified config files.
2. git clone "$repoUrl" /workspace fails with fatal: destination path '/workspace' already exists and is not an empty directory. → init exits non-zero → crashloop.

Weak value proposition: the marker's main pitch was failure-atomicity. But each init phase is already individually idempotent (mkdir -p, cp -r, the existing [ ! -d ] guards), and the marker doesn't unlock any meaningful "force re-init on version bump" semantics that the every-start phases don't already cover. Bringing back the implicit checks as layered guards to fix the migration would end up at a strictly more complex version of the original code.

#65 already solved the user-visible crashloop. This refactor is mostly aesthetic — not worth the migration risk.