feat(platform): source infra config from the app-config file (PLT-475)

[bdchatham]

What

Migrates the non-networking platform.Config fields off environment variables into the mounted app-config file (SEI_CONTROLLER_CONFIG → platform.FileConfig) that #397 established for state-sync syncers. This is PR-1 of 2 — the transitional half.

How

• platform.FileConfig gains grouped infra sections: scheduling, storage, resources, snapshot, resultExport, genesis, images (schema in docs/controller-app-config.md).
• platform.Load resolves Config at startup file-wins-else-env: a non-empty file value wins; an absent one falls back to its historical SEI_* env var. An unset SEI_CONTROLLER_CONFIG reproduces the original all-env behavior.
• platform.ReadFileConfig centralizes the file read/decode; the per-reconcile state-sync reader now shares it — removes the duplicate os.ReadFile/Unmarshal and preserves the fail-closed-vs-transient distinction.
• main.go calls platform.Load instead of the inline os.Getenv block.
• Config.Validate error messages name both the file key and the env var.

Decisions (aligned with the owner)

• Env-fallback transitional release (not a hard cut): file wins, env fallback. A follow-up PR drops the fallback + the env vars once the sei-controller-config ConfigMap is verified populated in the live env. No flag-day.
• Networking/gateway config excluded (SEI_GATEWAY_*, SEI_P2P_ENDPOINT_DOMAIN, SEI_NLB_TARGET_TYPE) — stays env-sourced pending its removal from the controller in PLT-451 (GitOps networking). Avoids migrate-then-delete churn.

Read model

Infra fields are read once at startup (an infra change warrants a restart); the stateSync section keeps its per-reconcile hot-reload. Same file, two read paths, by design.

Test

internal/platform/load_test.go: no-file (all-env), file-wins + env-fallback per field, configured-but-missing file (falls back, no error), malformed file (hard error — never silent env fallback), empty-path ReadFileConfig. go build, go vet, gofmt, and the platform + node-controller suites all pass.

Follow-up (PR-2, gated on ConfigMap populated + verified)

Drop the env fallback in platform.Load, remove the migrated env vars from config/manager/manager.yaml, finalize the CLAUDE.md convention to "file-authoritative."

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Changes how scheduling, storage, images, and S3 buckets are resolved at controller startup; misconfiguration or bad YAML can block startup, though env fallback limits rollout risk during the transition.

Overview
Moves most platform infra knobs from startup SEI_* env reads into the GitOps-mounted app-config file (SEI_CONTROLLER_CONFIG), while keeping networking/gateway settings env-only until PLT-451.

platform.Load and ReadFileConfig resolve Config at startup: non-empty file fields win, missing infra fields still fall back to their historical env vars (transitional PLT-475). A present but invalid YAML file fails startup instead of silently using env. Infra from the file is read once per process (restart required); stateSync still re-reads the same file each reconcile via the shared reader in canonicalSyncers.

FileConfig grows grouped sections (scheduling, storage, resources, snapshot, resultExport, genesis, images); main drops the inline os.Getenv block in favor of Load + Validate. Config.Validate errors now cite both the file key and env var. New docs/controller-app-config.md documents the schema and read model; load_test.go covers file-wins, env fallback, missing file, and malformed file behavior.

^{Reviewed by Cursor Bugbot for commit 4c4452f. Bugbot is set up for automated code reviews on this repo. Configure here.}