Declare docker-dev in a SaaS-only mise overlay

SaaS setup cloned/pulled docker-dev imperatively (gh repo clone / git pull)
with none of the fleet's origin or auth handling. Replace it with mise's
declarative repos phase, scoped to a mise.saas.toml environment overlay
loaded only under MISE_ENV=saas — private Basecamp infrastructure is
declared ONLY there, never in the OSS root .mise.toml, and OSS setups never
load or reach it.

saas/bin/setup now trusts the overlay, carries the fleet's fenced
docker-dev origin block (shipyard-block: docker-dev-origin v1 — https-auth
probe before fresh clones and canonical-ssh rewrites, guided stop on
missing auth, forks/dirty left for mise), and converges the checkout with
MISE_ENV=saas mise bootstrap --only repos --yes before starting services.

SaaS remains macOS/Omarchy-only, per the platform gate.

Author: jeremy

mise.saas.toml

@@ -0,0 +1,10 @@
+# SaaS-only mise overlay, loaded when MISE_ENV=saas (mise environment
+# configs: mise.saas.toml loads above .mise.toml in the same directory).
+#
+# Private Basecamp infrastructure is declared ONLY here — the OSS root
+# .mise.toml must never reference it. Consumed by saas/bin/setup, which runs
+# the repos phase under MISE_ENV=saas after proving https git auth.
+min_version = "2026.7.5"
+
+[bootstrap.repos]
+"~/Work/basecamp/docker-dev" = { url = "https://github.com/basecamp/docker-dev.git", ref = "master" }

saas/bin/setup

@@ -4,9 +4,46 @@ set -eo pipefail
 # SaaS-specific setup tasks
 # This script is called from the main Fizzy bin/setup when SAAS is enabled
 
+# docker-dev is declared in mise.saas.toml — the SaaS-only overlay, loaded via
+# MISE_ENV=saas — and converged declaratively through mise's repos phase. The
+# OSS root .mise.toml never references it; OSS setups never reach this file.
+step "Trusting SaaS mise overlay" mise trust --yes "$app_root/mise.saas.toml"
+
+# shipyard-block: docker-dev-origin v1
+# mise syncs docker-dev from the declared https URL: its repos preflight doesn't
+# equate ssh with https origins, and fresh clones use the URL as-is. docker-dev is
+# private and gh being installed does not imply its git credential helper is
+# configured (gh auth setup-git is a separate step), so prove https auth with a
+# noninteractive probe wherever mise is about to need it: before a fresh clone, and
+# before rewriting the canonical ssh origin of an existing checkout. On failure,
+# stop with guidance and leave any working ssh remote untouched. Forks, mirrors,
+# and dirty checkouts are left for mise to flag.
+docker_dev="$HOME/Work/basecamp/docker-dev"
+docker_dev_url="https://github.com/basecamp/docker-dev.git"
+docker_dev_https_ok() {
+  GIT_TERMINAL_PROMPT=0 GIT_ASKPASS=true git ls-remote "$docker_dev_url" HEAD > /dev/null 2>&1
+}
+docker_dev_auth_required() {
+  echo "docker-dev syncs from $docker_dev_url, but https git auth isn't set up." >&2
+  echo "Run: gh auth setup-git — then rerun bin/setup." >&2
+  exit 1
+}
+if [ ! -e "$docker_dev/.git" ]; then
+  docker_dev_https_ok || docker_dev_auth_required
+else
+  case "$(git -C "$docker_dev" config --get remote.origin.url || true)" in
+    git@github.com:basecamp/docker-dev|git@github.com:basecamp/docker-dev.git|ssh://git@github.com/basecamp/docker-dev|ssh://git@github.com/basecamp/docker-dev.git)
+      docker_dev_https_ok || docker_dev_auth_required
+      git -C "$docker_dev" remote set-url origin "$docker_dev_url";;
+  esac
+fi
+# shipyard-block-end: docker-dev-origin
+
+step "Syncing docker-dev" env MISE_ENV=saas mise bootstrap --only repos --yes
+
 if [ -e tmp/minio-dev.txt ]; then
-  step "Starting Docker services" bash -c "[ -d ~/Work/basecamp/docker-dev ] && git -C ~/Work/basecamp/docker-dev pull || gh repo clone basecamp/docker-dev ~/Work/basecamp/docker-dev && ~/Work/basecamp/docker-dev/setup minio"
+  step "Starting Docker services" ~/Work/basecamp/docker-dev/setup minio
   step "Configuring MinIO" bin/minio-setup
 fi
 
-step "Starting mysql" bash -c "[ -d ~/Work/basecamp/docker-dev ] && git -C ~/Work/basecamp/docker-dev pull || gh repo clone basecamp/docker-dev ~/Work/basecamp/docker-dev && ~/Work/basecamp/docker-dev/setup mysql80"
+step "Starting mysql" ~/Work/basecamp/docker-dev/setup mysql80