fix: point sentinel references at sso.gauchoracing.com

[BK1031]

• Point the dashboard OAuth authorize URL at sso.gauchoracing.com (dashboard/src/consts/config.tsx)
• Point the header's Sentinel settings link at the same host (dashboard/src/components/Header.tsx)
• Update the expected iss claim in auth (SentinelIssuer) and query (SENTINEL_ISSUER)
• Fix the deploy workflow's kustomization path, which pointed at a directory that no longer exists
• Add build.yml, aggregating the six service image builds into one check

Why the sentinel change

sentinel-v5.gauchoracing.com no longer resolves — dig returns nothing for it. Login on foundry redirects to https://sentinel-v5.gauchoracing.com/oauth/authorize?... and dead-ends there.

The live discovery document at https://sso.gauchoracing.com/.well-known/openid-configuration reports:

issuer:                 https://sso.gauchoracing.com
authorization_endpoint: https://sso.gauchoracing.com/oauth/authorize
jwks_uri:               https://sso.gauchoracing.com/api/core/keys

Sentinel's own source agrees — core/config/verify.go and oauth/config/verify.go both default Issuer to https://sso.gauchoracing.com.

The two issuer constants matter as much as the redirect. They are the expected iss claim, not URLs that get fetched, so fixing only the authorize URL would have gotten past login and then rejected every token as issuer-mismatched. auth/config/config.go already carried the comment "Must byte-match SENTINEL_URL" — and SENTINEL_URL is https://sso.gauchoracing.com in the manifests, so the invariant was documented but not enforced.

Deploy workflow

KUSTOMIZATION pointed at kubernetes/manifests/mapache/kustomization.yaml. That path was valid at 5948094 but moved when the infrastructure repo split into gr-prod / gr-foundry, and was never updated — so yq has been reading a nonexistent file and failing the step on every release since. Now targets kubernetes/gr-foundry/manifests/mapache/kustomization.yaml.

Also removed a duplicated path: the variable now holds the repo-relative path, prefixed with infra/ for filesystem access and used bare for git -C infra. The hardcoded path in the diff step is gone.

Verified by running the awk bump against the real gr-foundry kustomization: exactly the six SERVICES images change, with foreman (2.0.2) and kerbecs (3.2.0) untouched.

build.yml

Mirrors Sentinel's aggregator so branch protection has a single required status instead of twelve matrix checks. Two deliberate differences from Sentinel's version:

• Waits only on the six image builds. mapache-go / mapache-py trigger on push: branches: [main] with path filters, so they never run for a feature branch push — waiting on them would hang until timeout and fail every PR. publish.yml is release-only, same problem.
• Tag filter is v* rather than **, matching the service workflows. Library tags (mapache-py/*, mapache-go/*) don't trigger an image build, so ** would wait on runs that never start.

To enable: add Build as a required status check on main.

Note

auth, query and dashboard all changed, so this needs a full release rather than a dashboard-only one. The dashboard in particular must be rebuilt, not just redeployed — Vite substitutes import.meta.env.VITE_* at build time and bakes the literal into the bundle.