fix(demo): source local credentials and stop waiting on a job that no longer exists

The script demanded JENKINS_USER and JENKINS_TOKEN in the environment and said
only 'set JENKINS_USER' when they were missing, which is not enough to act on.
It now sources scripts/ops/hermes_triage_demo.env, git-ignored so it can hold
real tokens, and names that file when credentials are absent. An example file
records what belongs in it.

The fixture command also still polled for a hermes-demo-repair-<build> Job.
That Job stopped existing when the repair became an in-process ConfigMap
patch, so the command would have waited its full 400 seconds and then reported
nothing. It now watches the fixture returning to healthy, which is what
actually happens.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitignore

@@ -21,3 +21,6 @@ tmp/
 *.tfstate.*
 crash.log
 terraform/atlas/generated/
+
+# Local demo credentials (never commit)
+scripts/ops/hermes_triage_demo.env

scripts/ops/hermes_triage_demo.env.example

@@ -0,0 +1,15 @@
+# Copy to hermes_triage_demo.env (same directory) and fill in.
+# That filename is git-ignored so it can hold real tokens.
+
+# Jenkins API token: https://ci.bstein.dev -> your user -> Configure -> API Token
+export JENKINS_USER="your-jenkins-user"
+export JENKINS_TOKEN="your-jenkins-api-token"
+
+# Gitea token, used only to report open pull requests during preflight.
+# Preflight still works without it; that one line will read "?".
+export GITEA_TOKEN="your-gitea-token"
+
+# Override only if you are not pointing at the usual lab.
+# export JENKINS_URL="https://ci.bstein.dev"
+# export GITEA_URL="https://scm.bstein.dev"
+# export CODE_REPO_DIR="$HOME/Development/hermes-code-demo"

scripts/ops/hermes_triage_demo.sh

@@ -6,12 +6,22 @@
 #   hermes_triage_demo.sh status    # current incident/alert state, no changes
 #   hermes_triage_demo.sh preflight # confirm the lab is ready to demo
 #
-# Requires JENKINS_USER and JENKINS_TOKEN in the environment (a Jenkins API
-# token) plus kubectl access to the cluster. Nothing here mutates the cluster
+# FIRST RUN: copy hermes_triage_demo.env.example to hermes_triage_demo.env in
+# this directory and fill it in. That file is git-ignored precisely so it can
+# hold real tokens; this script sources it automatically, so nothing needs to
+# be exported by hand.
+#
+# Needs kubectl access to the cluster as well. Nothing here mutates the cluster
 # directly: the fixture demo only asks Jenkins to run a parameterized build,
 # and the code demo only pushes a seeded defect to the demo repository.
 set -euo pipefail
 
+# Local, git-ignored credentials. Sourced before anything else so every value
+# below can be overridden from it.
+_DEMO_ENV="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/hermes_triage_demo.env"
+# shellcheck disable=SC1090
+[ -r "$_DEMO_ENV" ] && . "$_DEMO_ENV"
+
 JENKINS_URL="${JENKINS_URL:-https://ci.bstein.dev}"
 FIXTURE_JOB="hermes-triage-demo"
 CODE_JOB="hermes-code-demo"
@@ -22,7 +32,11 @@ say() { printf '\n\033[1m[%s] %s\033[0m\n' "$(date -u +%H:%M:%S)" "$*"; }
 note() { printf '        %s\n' "$*"; }
 
 require_jenkins() {
-  : "${JENKINS_USER:?set JENKINS_USER}" "${JENKINS_TOKEN:?set JENKINS_TOKEN}"
+  if [ -z "${JENKINS_USER:-}" ] || [ -z "${JENKINS_TOKEN:-}" ]; then
+    echo "Missing Jenkins credentials." >&2
+    echo "Create $_DEMO_ENV from hermes_triage_demo.env.example and fill it in." >&2
+    exit 1
+  fi
 }
 
 jenkins_get() { curl -sk -u "$JENKINS_USER:$JENKINS_TOKEN" "$JENKINS_URL$1"; }
@@ -117,11 +131,11 @@ cmd_fixture() {
   note "result: $(wait_for_build "$FIXTURE_JOB" "$next_num")"
 
   say "Ariadne detects, gathers evidence, asks Hermes, authorizes, repairs"
-  local repair="hermes-demo-repair-$next_num"
+  note "the repair is a single in-process ConfigMap patch, so watch the fixture"
   for _ in $(seq 1 40); do
     sleep 10
-    if [ "$(kubectl -n "$DEMO_NS" get job "$repair" -o jsonpath='{.status.succeeded}' 2>/dev/null)" = "1" ]; then
-      note "repair job $repair succeeded"
+    if [ "$(kubectl -n "$DEMO_NS" get cm hermes-triage-demo-fixture -o jsonpath='{.data.state}' 2>/dev/null)" = "healthy" ]; then
+      note "fixture patched back to healthy"
       break
     fi
   done