feat(gateway-image): smoke the broker-free Compass boot (RIG-2862)

[rigel-mintaka]

Summary

Preparation for task I1 in the boot wiring record (compass #2213). The gateway-image smoke now targets the broker-free Compass boot.

• Fake Compass: the smoke runs a TLS fake Compass Server on host 127.0.0.1. Its cert comes from compass-gen-cert with SANs host.containers.internal and 127.0.0.1. It answers GatewayAuth/VerifyAgentToken with the same Connect wire the fork verifier uses.
• Gateway run: --network pasta:--map-host-loopback,169.254.1.2, the service token mounted :ro,Z, the CA mounted :ro,z, and COMPASS_SERVER_URL set to the fake server's host.containers.internal address.
• Checks: /healthz, a valid token gets the /v1/models list, a bad token gets 401, and the container exits 143 on stop.
• Faults (each exits 7):
  • no-server-env: the container exits non-zero before bind.
  • wrong-token: the door rejects the service token, so the valid-token check fails.
• core.ts: removes COMPASS_GATEWAY_TOKEN_FILE from the secret-name allowlist and adds fakeCompassDoorResponse, with unit tests.
• release.yml:
  • puts the pinned Go on PATH for compass-gen-cert;
  • adds the gen-cert closure paths;
  • pins publish-gateway-image to ubuntu-26.04. --map-host-loopback needs passt from 2024-08-21 or later, and 24.04's passt predates it.

Draft until

The full smoke needs a fork image with the Compass boot (fork #153). This PR stays draft until #2213 freezes and the fork-pin.json bump lands on top of it.

Tests

• tools/gateway-image: bun test passes 79 of 79; tsc and biome are clean.
• The fake door was smoke-tested with curl and the generated CA: a good token gets 200, a bad token gets 401.
• The full podman smoke has not run yet; see "Draft until" above.
• actionlint reports ubuntu-26.04 as an unknown label, because its label list predates 26.04. Its other errors also occur on main.

Ledger-impact: none. The record changes in #2213.

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[linear-code]

RIG-2862

[github-actions]

Compass engineering docs preview: https://compass-gateway-rig-2862-gat.compass-eng-docs.pages.dev

Deployed from compass-gateway/rig-2862-gateway-smoke at 4987fb1.

Changed pages:

• tools/gateway-image/README.md

[rigel-mintaka]

Review at head 4987fb1a: a single-pass review found 1 medium. The wrong-token fault did not make the smoke fail. Fixed before the first push: the fault now makes the fake door reject the service token, so the valid-token check fails and the smoke exits 7. The bad-agent-token 401 check now always runs.

Open: 0 high, 0 medium. The full podman smoke is pending the F3 fork pin (see "Draft until").