deploy-app

Deploy an App and verify it end-to-end. Use `KUBECONFIG=infra/local/bex.kubeconfig` if no other cluster is targeted. Requires `BEX_API_URL` and `BEX_API_TOKEN` in the environment (`scripts/app-apply.sh` reads them and fails with `set BEX_API_URL` if unset — both are client-supplied, not in `.env.example`; `BEX_API_PUBLIC_URL` in `.env.example` is the unrelated backend DeployHook origin). `BEX_API_TOKEN` is the Hydra-issued Bearer token (API key minted via `/v1/api-keys`), not the removed static shared secret. Optional `BEX_OWNER_ID`, `BEX_REPO`, `BEX_BRANCH` narrow the deploy. 1. If `$ARGUMENTS` is a path to a `render.yaml` (or legacy `bex.yml` alias — canonical is `render.yaml`, see `scripts/app-apply.sh`), apply it with `DRY_RUN=1 bash scripts/app-apply.sh $ARGUMENTS` first and show the generated App CR, then `bash scripts/app-apply.sh $ARGUMENTS` to deploy. If `$ARGUMENTS` is a directory, pass the directory — the script discovers `render.yaml` then `bex.yml` inside it. Otherwise apply the sample: `kubectl apply -f examples/whoami-app.yaml`. 2. Watch until ready: poll `kubectl get apps.app.bex.co <name> -o jsonpath='{.status.phase} {.status.revision} {.status.url}'` until phase is `Ready` (timeout ~3 minutes; on timeout, show `kubectl describe apps.app.bex.co <name>` and the operator logs `kubectl -n bex-system logs deploy/bex-controller-manager --tail=50`). 3. If `status.url` is set and resolvable, `curl -fsS` it (use `--resolve`/`-k` only if the local mock has no real DNS/TLS) and show the response status. 4. Report: App name, phase, revision, url, and where the pods landed (`kubectl get pods -l app.bex.co/app=<name> -o wide`).