feat(setup): prompt for the chat key in k8s mode

The dev and compose flows minted a chat key and wrote the Chat opt-out
alongside it; k8s did neither, so a cluster install with no COPILOT_API_KEY in
its Helm values rendered a Chat module that rejects every message.

Prompt with the same flow and feed both values into `app.env`, which the chart
already renders as arbitrary container env. Reading the previous release's key
matters here in a way it does not for the file-based modes: `helm upgrade`
without `--reuse-values` keeps only what this document carries, so a key the
user elects to keep has to be re-supplied or it is silently dropped.

Splits the release-values read from the secret-reuse check so both the key and
the secrets come from one `helm get values` call, and carries the mothership
override across for the same mint-here-validate-there reason the other modes
document.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ErcRgvi7VQBeKDQ3MBMha

Author: TheodoreSpeaks

scripts/setup/modes/k8s.ts

@@ -6,6 +6,7 @@ import { generateSecret, ROOT } from '../env-files.ts'
 import { SetupError } from '../errors.ts'
 import { waitFor } from '../probes.ts'
 import * as p from '../prompter.ts'
+import { chatFlagValues, mothershipOverride, promptCopilotKey } from '../steps.ts'
 import { glyph, theme } from '../theme.ts'
 
 const APP_URL = 'http://localhost:3000'
@@ -276,15 +277,29 @@ async function helmInstall(
   }
 }
 
-function existingReleaseSecrets(context: string): Record<string, string> | null {
+interface ReleaseValues {
+  app?: { env?: Record<string, string> }
+  postgresql?: { auth?: { password?: string } }
+}
+
+/** Values of the installed release, or `null` when there is no release yet. */
+function existingReleaseValues(context: string): ReleaseValues | null {
   const scope = ['--kube-context', context, '-n', NAMESPACE]
   const status = spawnSync('helm', ['status', RELEASE, ...scope], { stdio: 'ignore' })
   if (status.status !== 0) return null
-  const values = JSON.parse(
+  return JSON.parse(
     run('helm', ['get', 'values', RELEASE, ...scope, '-o', 'json'], 'helm get values failed')
-  ) as { app?: { env?: Record<string, string> }; postgresql?: { auth?: { password?: string } } }
-  const env = values.app?.env ?? {}
-  const password = values.postgresql?.auth?.password
+  ) as ReleaseValues
+}
+
+/**
+ * The previous release's secrets, or `null` when any are missing — a partial set
+ * cannot be reused, since regenerating only some of them invalidates sessions
+ * and stored credentials encrypted under the originals.
+ */
+function reusableSecrets(values: ReleaseValues | null): Record<string, string> | null {
+  const env = values?.app?.env ?? {}
+  const password = values?.postgresql?.auth?.password
   if (
     !env.BETTER_AUTH_SECRET ||
     !env.ENCRYPTION_KEY ||
@@ -323,7 +338,8 @@ export async function runK8sMode(detection: Detection): Promise<void> {
   // credentials to an unintended cluster.
   const context = await ensureLocalContext(detection)
 
-  const reused = existingReleaseSecrets(context)
+  const releaseValues = existingReleaseValues(context)
+  const reused = reusableSecrets(releaseValues)
   const secrets = reused ?? {
     BETTER_AUTH_SECRET: generateSecret(),
     ENCRYPTION_KEY: generateSecret(),
@@ -333,6 +349,21 @@ export async function runK8sMode(detection: Detection): Promise<void> {
   }
   if (reused) p.log.step('Reusing secrets from the existing release')
 
+  // Before the key is minted: a half-set override mints against one environment
+  // and validates against the other, and warning afterwards is too late — the
+  // bad key is already deployed.
+  const overrides = mothershipOverride()
+  const copilotKey = await promptCopilotKey(releaseValues?.app?.env?.COPILOT_API_KEY)
+
+  // `helm upgrade` without `--reuse-values` keeps only what this document
+  // carries, so a key the user chose to keep has to be re-supplied here.
+  const appEnv: Record<string, string> = {
+    ...secrets,
+    ...overrides,
+    ...(copilotKey ? { COPILOT_API_KEY: copilotKey } : {}),
+    ...chatFlagValues(copilotKey),
+  }
+
   const spin = p.spinner()
   spin.start('helm upgrade --install (first run pulls images — this can take several minutes)…')
   try {
@@ -355,7 +386,7 @@ export async function runK8sMode(detection: Detection): Promise<void> {
         '--timeout',
         '15m',
       ],
-      secretValues(secrets),
+      secretValues(appEnv),
       context,
       spin
     )