chore(deploy): remove orphaned base manifests and add orphan check

[rh-amarin]

Summary

• Delete deploy/base/{api-server,control-plane,platform}: leftovers from the platform/applications split (refactor(deploy): separate platform and application GitOps packages #355). No kustomization referenced them, and they had drifted from the live copies in base/applications and base/platform-resources (e.g. sslmode=disable, old health port), yet update-openshell still named control-plane/deployment.yaml as the image-pin source of truth.
• Repoint stale deploy/base/controller.yaml / api-server.yaml references (comments, skills, specs) to the real files; platform-resources/controller.yaml is now the single source of truth for image pins.
• Add scripts/check_deploy_orphans.py (make check-deploy-orphans, part of make check) to fail on any deploy/base YAML not reachable from a kustomization.

Verification

• kustomize build output is byte-identical before/after for base, kind, openshift, ibm, hub, gitops/platform, gitops/applications.
• hypershell-gitops consumes only deploy/hub, deploy/gitops/platform, deploy/base/keycloak/theme and gitops-base/components/openshift-dashboard-metrics; none touch the deleted paths.
• Pre-commit policy checks pass. No unit test yet for the new check script.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository YAML (base), Central YAML (inherited)
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 5298cfbd-b3e1-407e-b98e-81a72318139c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[hypershell-delivery]

Amber review

Status: Complete

View the submitted review.

[hypershell-delivery]

Verdict

This remains a clean, well-scoped deploy-tree cleanup: the orphaned deploy/base/{api-server,control-plane,platform} manifests are removed, every doc/comment/spec/script reference is repointed to the surviving deploy/base/applications/api-server.yaml and deploy/base/platform-resources/controller.yaml, and a check-deploy-orphans guard is wired into make check. I land at COMMENT only to surface a cross-PR coordination issue that needs a maintainer merge-order decision; the change itself is sound.

Findings

No new findings in this PR.

I re-verified at head 4366278:

• python3 scripts/check_deploy_orphans.py exits 0 (no orphans remain).
• python3 -m unittest scripts/test_check_deploy_orphans.py passes all 4 cases, including the self-contained dead-subtree case (exit 1) and the overlay-referenced subtree case (exit 0).
• deploy/base/kustomization.yaml references only platform-resources and applications; the deleted control-plane/, api-server/, and platform/ directories were unreferenced, so the orphan guard confirms they were genuine orphans.
• The only surviving textual mention of a deleted path is the intentional changelog note in skills/tooling/update-openshell/SKILL.md recording the prior wrong-path correction; it is not a live reference.

Notes (non-blocking)

• The PR body claims kustomize build output is byte-identical before/after for all overlays. kustomize is not available in the review sandbox, so I could not reproduce that assertion; a reviewer with kustomize should confirm it. The reference repointing is internally consistent and the orphan check confirms the deleted paths were genuinely unreferenced.

Cross-PR coordination

A separate open pull request (#479, the OpenShell v0.1.2-rhaiv.7 bump) edits deploy/base/control-plane/deployment.yaml - the file this PR deletes - to re-pin GATEWAY_IMAGE / GATEWAY_SUPERVISOR_IMAGE, keeps it in sync with deploy/base/platform-resources/controller.yaml on the premise that the pair must agree, and also edits the same skills/tooling/update-openshell/SKILL.md and several specs/platform/* files. This PR deletes deploy/base/control-plane/deployment.yaml as a redundant orphan, makes platform-resources/controller.yaml the single source of truth, and rewrites the skill to drop the "both must agree" guidance. The two PRs encode opposite assumptions about that manifest, so they need a maintainer decision rather than an automatic merge:

• Decide merge order and confirm platform-resources/controller.yaml is the single source of truth for the image pins.
• Ensure #479's image-pin bump lands in the surviving deploy/base/platform-resources/controller.yaml, and that the half of #479 targeting the deleted deploy/base/control-plane/deployment.yaml is dropped rather than silently lost or resurrecting the removed file. If #479 merges after this PR and re-adds deploy/base/control-plane/deployment.yaml, the new check-deploy-orphans guard in make check will flag it as an orphan (it is referenced by no kustomization), so the resurrection surfaces as a failing policy check rather than silently.
• Reconcile the conflicting edits to skills/tooling/update-openshell/SKILL.md and the shared specs/platform/* files: #479 still names control-plane/deployment.yaml as a source-of-truth pin location, while this PR removes those references.

Previous concerns

• [Minor] Orphan guard misses an orphaned subtree that carries its own kustomization.yaml (discussion) - addressed. main() restricts roots to [k for k in kustomization_files() if BASE not in k.parents or k.parent == BASE], and a nested base kustomization.yaml enters the reachable set only when a reachable parent references its directory (scripts/check_deploy_orphans.py). The companion test_orphan_subtree_with_own_kustomization_fails asserts exit 1 for a self-contained dead subtree, and I re-confirmed the suite passes (4/4) and the policy exits 1 on that synthetic case. I am not opening a new inline thread for this; see the linked discussion.
• [Minor] Stray blank line in the check-deploy-orphans recipe (previous review) - addressed. Makefile now places the python3 scripts/check_deploy_orphans.py recipe directly under check-deploy-orphans: test-deploy-orphans-policy with no intervening blank line.

The committer addressed the previous concerns.

Findings Summary (ordered by severity, highest first)

1. [Minor] Cross-PR coordination: another open PR re-pins images in the duplicate control-plane manifest this PR deletes and edits the same skill/specs; needs a merge-order and single-source-of-truth decision - Cross-PR coordination

Convention Checklist

Convention	Result
Conventional commit messages	Pass
Image references consistent across the stack (single source of truth)	Pass
Doc/comment/spec references point to real files	Pass
make check guard wired in and functional (incl. orphan-subtree case)	Pass
Test changes additive, new guarantees covered by tests	Pass
No secrets in logs or responses	Pass