Pass a store's licence token to the server, and say at boot when Intelligence will refuse memory

[guidovizoso]

Two fixes from deploying OpenBot with self-hosted Intelligence on EKS. Each cost real time, and in both cases nothing reported the problem.

1. A licence token from a store never reached the server

The chart emitted COPILOTKIT_LICENSE_TOKEN only when secrets.licenseToken was a literal. With externalSecrets, which ci/eks-values.yaml itself uses with license-token in its data, the token reached the Secret and never the pod.

openbot.licenseTokenSource now decides where the token comes from:

source	env var
secrets.licenseToken literal	required ref (as before)
externalSecrets.data names license-token	required ref (new)
secrets.existingSecret	optional: true ref (new; the chart can't read that Secret's keys)
none of the above	not emitted (managed Intelligence, as before)

Guard: scripts/check-rendered-chart.ts only compared demanded keys with Secrets the chart writes, not with what an ExternalSecret syncs. It now fails a render in which a store syncs a key nothing reads. With the old template condition restored, it fails eks and eks-sandbox:

::error::ExternalSecret "ci-openbot-secrets" syncs "license-token", which nothing in this render reads.

With the fix, all five targets pass lint, render and the check.

2. A self-hosted Intelligence without its own licence refuses memory silently

That Intelligence answers every runtime entitlement read with RUNTIME_ENTITLEMENTS_SELF_HOSTED_MISCONFIGURED. Memory is refused, conversations carry on, and OpenBot's log says nothing. The licence has to be on Intelligence's deployment as well as OpenBot's, and that's the part that's easy to miss.

The server now reads the runtime entitlement once at boot, without waiting on it, and logs:

• intelligence-entitlement-not-ready with the code, Intelligence's message, and a fix. The fix names appApi.licenseSecret / externalSecrets.secrets.license for misconfigured, says to renew for expired, and calls managed-unavailable temporary.
• intelligence-entitlement-unreadable when Intelligence can't be asked.

The self-host banner reads the same answer, but only while the banner is enabled, so it couldn't be the thing that reports this.

The docs (README, chart README, values.yaml, configuration.md, deployment.md) now say the licence goes on both sides.

Checks

• New intelligence-entitlement-check.test.ts, 8 tests: ready, inactive, misconfigured with fix text, expired, unknown code, logs once, silent when ready, unreachable doesn't throw. It passes together with the existing self-host-banner tests, 30 in all.
• tsc and biome are clean.