feat(dbos): add opt-in DBOS Conductor support

[pedrofrxncx]

Summary

• Wire DBOS_CONDUCTOR_KEY / DBOS_CONDUCTOR_URL env vars into DBOS.launch() in apps/mesh/src/index.ts. When unset, behavior is unchanged.
• Add a dbosConductor block to deploy/helm/studio/: opt-in (enabled: false by default), supports either an inline key (written into the chart-managed Secret) or a pre-existing Secret via existingSecret / existingSecretKey.
• Helm validations reject misconfigured combinations (enabled w/o key or existingSecret; both key and existingSecret set; secret.secretName set without dbosConductor.existingSecret — since the chart-managed Secret is skipped in that case).

Context

DBOS Conductor is an out-of-band management service that dials over WebSocket to provide workflow recovery across executors, observability dashboards, and retention. Conductor is not on the request path — disconnects don't affect serving traffic; the SDK reconnects in the background.

The smallest viable deployment shape is "managed Conductor": no extra K8s manifests needed, just an outbound wss:// connection and an API key from DBOS Cloud. This PR is exactly that.

A self-hosted Conductor deployment (Conductor + Console + their own Postgres) is a much larger lift and is intentionally not included here. If/when we want it, dbosConductor.url already accepts a custom endpoint.

Test plan

• helm template with default values: no DBOS_CONDUCTOR_* env vars rendered, no behavior change.
• helm template with dbosConductor.enabled=true --set dbosConductor.key=…: DBOS_CONDUCTOR_KEY written into chart-managed Secret and referenced via secretKeyRef in the Deployment.
• helm template with dbosConductor.existingSecret=…: DBOS_CONDUCTOR_KEY not written into chart-managed Secret; Deployment references the external Secret.
• helm template validation failures: enabled without key, both key+existingSecret, secret.secretName set without existingSecret — all fail with clear messages.
• tsc --noEmit clean on apps/mesh.
• Smoke test against a real DBOS Cloud account in a non-prod namespace before flipping enabled: true on any environment.

🤖 Generated with Claude Code

---

Summary by cubic

Add opt-in DBOS Conductor integration. When enabled, the app dials Conductor for workflow recovery, observability, and retention; default behavior is unchanged.

• New Features

  • Wire DBOS_CONDUCTOR_KEY and optional DBOS_CONDUCTOR_URL into DBOS.launch() (only passed when a key is set).
  • Helm: add dbosConductor block (enabled=false by default) with key, url, existingSecret, and existingSecretKey.
  • Deployment injects DBOS_CONDUCTOR_KEY/URL; chart-managed Secret stores the key when provided inline.
  • Helm validations prevent invalid combos (enabled without key/secret, key+existingSecret together, or secret.secretName without dbosConductor.existingSecret).
  • Bump Helm chart version to 0.6.5.

• Migration

  • To enable via Helm: set dbosConductor.enabled=true and either dbosConductor.key=<api-key> or dbosConductor.existingSecret=<name>.
  • Optionally set dbosConductor.url to override the SDK’s default conductor URL.

^{Written for commit 5384b2e. Summary will update on new commits. Review in cubic}

[github-actions]

🧪 Benchmark

Should we run the Virtual MCP strategy benchmark for this PR?

React with 👍 to run the benchmark.

Reaction	Action
👍	Run quick benchmark (10 & 128 tools)

Benchmark will run on the next push after you react.

[github-actions]

Release Options

Suggested: Minor (2.337.0) — based on feat: prefix

React with an emoji to override the release type:

Reaction	Type	Next Version
👍	Prerelease	2.336.3-alpha.1
🎉	Patch	2.336.3
❤️	Minor	2.337.0
🚀	Major	3.0.0

Current version: 2.336.2

Note: If multiple reactions exist, the smallest bump wins. If no reactions, the suggested bump is used (default: patch).

[cubic-dev-ai]

No issues found across 5 files

_{Re-trigger cubic}