fix(demo): update routing and deploy script for GKE Substrate deployment

[Mofi Rahman (moficodes)]

• PR #1333
  • Removed CoreDNS / atenet-dns entirely: Deleted manifests/ate-install/atenet-dns.yaml and the entire cmd/atenet/internal/dns/ package.
  • Removed Host-header routing: Replaced the convention of dialing <actor>.<atespace>.actors.resources.substrate.ate.dev with an explicit HTTP header: ate-target-actor: <atespace>/<actor>.
• PR #1536
  • Changed --template-ref to --template

The demo was not working without these change.

These changes are backward compatible so no existing substrate deployment should fail with these, but newer substrate deployment will not work without these changes.

[Mofi Rahman (moficodes)]

Maya Wang (@mayawang) PTAL

[Maya Wang (mayawang)]

Hi Mofi Rahman (@moficodes) ! Thanks for picking this up! I tested it on two clusters running the release-0.1 build the demo README pins (c48b3a3c), and it doesn't work there yet.

The ate-target-actor header comes from agent-substrate/substrate#1333, which moved actor routing off the Host header, and that's only on main. On release-0.1 a header-only request to the router comes back 404, while the same actor addressed by hostname reaches the resume path. Same story for --template: the rename from --template-ref in agent-substrate/substrate#1536 isn't on release-0.1 either, so the actor create in deploy-demo.sh fails there, and the 2>/dev/null || echo "actor exists" hides it.

So I think it's one of these:

• Move the README pin to a main SHA that has both changes, and drop the backward compatible wording.
• Make it genuinely work with both: send the router request with the header and the actor Host together, and give deploy-demo.sh the same --template-ref then --template fallback that kubectl-ate-client.ts already has.

I'd lean toward the second, since release-0.1 is what people will install from the README.

A few smaller things:

• The rewrite in acp-runtime.ts matches on the literal actors.resources.substrate.ate.dev, so a custom actorDomain skips it without any error. Checking against the configured domain would cover that, and one helper for the router URL would replace the three copies of the default.
• /api/churn/stop now suspends oc-agent too, which is the main agent rather than a churn actor. It also walks all 18 fleet actors one at a time, twice.
• deploy-demo.sh deletes the template before the actor. If the actor is running, the actor delete fails and set -e stops the script. The second recreate block after golden_ready also looks like it duplicates the first.

Let me know if it'd help to pair on the dual-mode version!

[Mofi Rahman (moficodes)]

Went with the second option. 88a9ffb makes it work on both release-0.1 and main:

• Actor requests now go to the router with both the actor Host and the ate-target-actor header, in the plugin (acp-runtime.ts, via a new fetchActor in actor-router.ts) and in the dashboard. It uses node:http instead of fetch, because fetch drops a custom Host header.
• deploy-demo.sh tries --template-ref first and falls back to --template on "unknown flag", like kubectl-ate-client.ts. Only "already exists" is treated as OK; anything else stops the script with the CLI output.
• The literal-domain checks in acp-runtime.ts are gone. The Host comes from the configured actorDomain, and a single routerUrl() helper (with a ROUTER_URL override) replaces the three copies of the default.
• /api/churn/stop now only sets the flag. It no longer touches oc-agent, and the fleet is parked once, by the existing sweep.
• deploy-demo.sh now suspends and deletes the actor before the template. The second recreate block is gone.
• Removed the "backward compatible" wording from the docs. The README, ARCHITECTURE.md and the plugin README describe both flags and both addressing modes.

Tested on two clusters:

• A fresh GKE cluster on release-0.1 at c48b3a3c. A header-only request to the router got a 404 there, which matches what you saw; Host plus header got a 200. Also tested: deploy, re-deploy with the actor running, dashboard burst/churn/stop, and a two-turn conversation plus cancel through the plugin.
• A cluster on main. Same paths: header-only 200, Host-only 404, both 200.

One thing on main that this PR doesn't fix: since substrate f980a57d, actors have no egress unless they have an EgressPolicy, so the actor on main can't reach Gemini and turns come back empty. Routing works. We will need to fix that for this demo.

[Maya Wang (mayawang)]

LGTM, thanks for going the dual-mode route and testing on both! Sending both the Host and the header is a nice clean fix.

For the egress gap on main, want to open an issue for it so we can track it separately? Happy to help sort out the EgressPolicy side.