fix(chart): default relay_signing_public_key to Nudgebee Cloud relay key

[RamanKharchee]

Description

The nudgebee-agent chart already defaults the SaaS prod triple — runner.relay_address: wss://relay.nudgebee.com/register and runner.nudgebee.endpoint: https://collector.nudgebee.com — but left runner.nudgebee.relay_signing_public_key: ''.

With an empty relay key, the agent's relay-signature verifier is disabled (relaysig.NewVerifier("") → Enabled()==false). The relay signs every k8s request body, but the agent ignores the signature, so relay-signed UI mutations fall through to the light-action allowlist in pkg/auth.Validate. Since mutations are deliberately not light actions, every workload mutation is rejected:

auth: action "replace_workload" not in light-action allowlist

(also delete_pod, create_workload, delete_workload, rollout_restart, replica_rightsizing, …). Reads keep working because read primitives are light actions — the classic "reads fine, mutations 401" symptom.

Any agent installed against Nudgebee Cloud without the in-app install command — manual helm install, CI-driven installs — hits this, because only the UI install command injects the key (--set-string runner.nudgebee.relay_signing_public_key=... from the server's SIGNING_PUBLIC_KEY).

Fix

Pair the key with the already-defaulted relay: default relay_signing_public_key to Nudgebee Cloud's relay public Ed25519 key, so a plain helm install against Cloud authorizes mutations out of the box.

• The value is a public verification key (no secret) — already served publicly at /api/public/app_config, and cross-verified against the prod cluster's nudgebee secret SIGNING_PUBLIC_KEY.
• Same SaaS-default posture as the relay/endpoint URLs the chart already ships.
• The UI install command still overrides it via --set-string.
• Self-hosted relays override it alongside relay_address (the comment now says so); comma-separate multiple keys during a rotation.
• No regression for self-hosted: a wrong/empty key both fall through to light-actions (reads OK, mutations 401) — identical observable behavior.

Chart version bumped 0.1.5 → 0.1.6 (RC releases derive their tag from Chart.yaml version).

Type of change

• Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

• Diagnosed live on the iteration-prod agent (and the tracked nudgebee-prod-agent): both connect to wss://relay.nudgebee.com with no RELAY_SIGNING_PUBLIC_KEY env → reproduces the rejection.
• Confirmed prod relay-server signs (SIGNING_PRIVATE_KEY present, recent image) and the public key matches /api/public/app_config.
• helm lint passes (only the expected missing-subchart-dependency warning).
• Verified the _helpers.tpl guard {{- if .Values.runner.nudgebee.relay_signing_public_key }} now renders the RELAY_SIGNING_PUBLIC_KEY env (empty default previously skipped it — matching the broken live state).

Review Notes → Risks & Counterarguments

• Prod key in a public/OSS chart — it's a public signature-verification key, already disclosed via /api/public/app_config, and consistent with the chart's existing relay.nudgebee.com / collector.nudgebee.com defaults.
• Key rotation — the verifier accepts comma-separated keys, so rotation publishes old+new; chart-default agents are no worse than today (no key at all).

Rollout note (not in this PR)

iteration-prod and nudgebee-prod-agent pin chart versions, so they won't pick up the new default until upgraded. Immediate unblock for a pinned release:

helm upgrade <release> -n <ns> --reuse-values \
  --set-string runner.nudgebee.relay_signing_public_key=KhVqjHRomIZCykcVnxlCoZBUr932GqbaullQd4G/+Zs=

🤖 Generated with Claude Code

[github-actions]

📦 Image Tags Updated

I've automatically updated the image tags in `charts/nudgebee-agent/values.yaml` to the latest versions from GHCR for the `main` branch.

The image tags are now synchronized with the latest builds and ready for release.

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[gemini-code-assist]

Code Review

This pull request bumps the Helm chart version of nudgebee-agent to 0.1.6 and configures a default value for relay_signing_public_key in values.yaml, which corresponds to Nudgebee Cloud's relay key. The documentation comments have also been updated to explain the default key behavior, how to override it, and how to handle key rotation. There are no review comments, so I have no feedback to provide.