gitea: fill repositories.json through the provisioner client, so an approved value lands at once (issue 1128)

The file was merged by the controller (merge, takes-config), which writes a
config change only on the node's next send (ADR 0348 §10): the operator's
Approve of the mesh-delivery repository set the value and nothing made it.
A plain template saying ${config:repositories} is filled by the provisioner
client on config-changed, and the node-engine reruns the run-once program
that names the file under restart-on.

modules/gitea/cmd/repositories/manifest_test.go

@@ -3,6 +3,7 @@ package main
 import (
 	"encoding/json"
 	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 )
@@ -35,14 +36,33 @@ func TestManifestDeclaresTheValueAndItsTrigger(t *testing.T) {
 	}
 	var file, process map[string]any
 	for _, r := range m.Resources {
-		for _, k := range strs(r["takes-config"]) {
-			if k == ConfigKey {
-				file = r
-			}
+		if r["id"] == "repositories-file" {
+			file = r
 		}
 	}
 	if file == nil || file["type"] != "file" {
-		t.Fatalf("no file takes the value %s", ConfigKey)
+		t.Fatalf("no file repositories-file")
+	}
+	// 1128/AC1: a plain template the provisioner client fills, so an approved value lands at once: a file the
+	// controller merges (merge, takes-config) takes a config change only on the node's next send (ADR 0348 §10).
+	if file["merge"] != nil || file["takes-config"] != nil {
+		t.Errorf("repositories-file is merged by the controller (merge %v, takes-config %v), want a plain template",
+			file["merge"], file["takes-config"])
+	}
+	text, err := os.ReadFile("../../" + file["template"].(string))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(text), "${config:"+ConfigKey+"}") {
+		t.Fatalf("the template %s does not say ${config:%s}: %s", file["template"], ConfigKey, text)
+	}
+	filled := filepath.Join(t.TempDir(), "repositories.json")
+	value := `{"mesh-delivery":{"private":false,"description":"d"}}`
+	if err := os.WriteFile(filled, []byte(strings.ReplaceAll(string(text), "${config:"+ConfigKey+"}", value)), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if v, err := ReadValue(filled); err != nil || len(v) != 1 || v["mesh-delivery"].Description != "d" {
+		t.Errorf("the filled template reads as %v, %v; want mesh-delivery", v, err)
 	}
 	for _, r := range m.Resources {
 		if r["type"] == "process" && has(strs(r["restart-on"]), file["id"].(string)) {