feat: rewrite operator — new CRDs, controllers, webhooks, storage, streaming, and CI

Rewrite the bobrapet operator with new API groups, controllers, webhooks, and runtime infrastructure.

API surface:
- Add runs.bubustack.io group (StoryRun, StepRun, StoryTrigger, EffectClaim, Trace, StructuredError, Schema types)
- Add catalog.bubustack.io group (shared template types)
- Add transport.bubustack.io settings types
- Add policy.bubustack.io ReferenceGrant
- Extend core CRDs (Story, Engram, Impulse) with execution overrides, schemas, and streaming configuration

Controllers and webhooks:
- StoryRun DAG reconciler with parallel-by-default execution
- StepRun controller with Job/Deployment/StatefulSet modes
- StoryTrigger controller with durable admission and dedup
- EffectClaim controller for reservation semantics
- Engram and Impulse controllers with template resolution
- Transport and TransportBinding controllers
- Admission webhooks for all mutable CRDs
- RBAC manager for per-StoryRun scoped permissions

Runtime:
- Storage offloading (S3-compatible) with inline/ref switching
- Template expression evaluation with Sprig functions
- In-process offloaded data resolution (controller mode)
- Operator configuration via ConfigMap with chain resolution
- Structured error contract for step failures
- OpenTelemetry tracing integration

Infrastructure:
- Kustomize manifests, RBAC, cert-manager, webhooks
- Helm chart generation via helmify
- GitHub Actions CI (lint, test, e2e, docker, release-please)
- Community health files (CoC, Security, Support, Contributing)
- Dependabot with grouped updates

Author: lanycrost

.devcontainer/devcontainer.json

@@ -1,8 +1,8 @@
 {
   "name": "Kubebuilder DevContainer",
-  "image": "golang:1.25",
+  "image": "docker.io/golang:1.25-bookworm",
   "features": {
-    "ghcr.io/devcontainers/features/docker-in-docker:2": {
+    "ghcr.io/devcontainers/features/docker-outside-of-docker:1": {
       "moby": false,
       "dockerDefaultAddressPool": "base=172.30.0.0/16,size=24"
     },
@@ -12,7 +12,9 @@
     }
   },
 
-  "runArgs": ["--privileged", "--init"],
+  "forwardPorts": [8080, 8443],
+
+  "runArgs": ["--privileged", "--init", "--network=host"],
 
   "customizations": {
     "vscode": {

.devcontainer/post-install.sh

@@ -90,6 +90,11 @@ if ! command -v kubectl &> /dev/null; then
   echo "kubectl installed successfully"
 fi
 
+# Install helm
+if ! command -v helm &> /dev/null; then
+  curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
+fi
+
 # Generate kubectl bash completion
 if command -v kubectl &> /dev/null; then
   if kubectl completion bash > "${BASH_COMPLETIONS_DIR}/kubectl" 2>/dev/null; then
@@ -142,6 +147,7 @@ echo "------------------------------------"
 kind version
 kubebuilder version
 kubectl version --client
+helm version
 docker --version
 go version
 

.github/.release-please-manifest.json

@@ -0,0 +1,4 @@
+{
+  ".": "0.1.1"
+}
+

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,45 @@
+---
+name: "Bug report"
+about: "Report a reproducible issue in an operator, transport, SDK, Engram, or Impulse"
+labels: ["kind/bug", "status/triage"]
+---
+
+## Component(s)
+- [ ] bobrapet (Story/StoryRun controllers)
+- [ ] bobravoz-grpc (transport operator)
+- [ ] bubu-sdk-go
+- [ ] Engram (name it below)
+- [ ] Impulse (name it below)
+- [ ] Docs / website
+
+If Engram/Impulse:
+```
+name:
+version/tag:
+execution mode (job / deployment / statefulset):
+```
+
+## What happened?
+Tell us what broke. Include the Story/StoryRun status, the expected behaviour, and what you observed instead.
+
+## Minimal reproduction
+1. Inputs/Story snippet (YAML or JSON)
+2. Commands you ran (`kubectl`, `make`, etc.)
+3. Cluster details (Kubernetes version, Kind/Minikube/managed cluster)
+
+```
+apiVersion: stories.bubustack.io/v1alpha1
+kind: Story
+metadata:
+  name: example
+spec:
+  ...
+```
+
+## Logs & traces
+- `kubectl logs` for controllers or Engrams (set `BUBU_DEBUG=true` if possible)
+- Relevant excerpts from `storyrun` / `steprun` status
+- TransportBinding / bobravoz logs if streaming is impacted
+
+## Additional context
+Anything else we should know? For example, custom overrides, secrets/providers, or recent upgrades.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security reports
+    url: https://github.com/bubustack/bobrapet/security/advisories/new
+    about: Please use our private reporting channel for vulnerabilities.
+  - name: Architecture & roadmap discussions
+    url: https://github.com/orgs/bubustack/discussions
+    about: For proposals that span multiple repositories, start a discussion before opening issues.

.github/ISSUE_TEMPLATE/docs_request.md

@@ -0,0 +1,21 @@
+---
+name: "Docs / community update"
+about: "Request a documentation, support, or example update"
+labels: ["kind/docs", "status/triage"]
+---
+
+## Area
+- [ ] Operator docs / architecture
+- [ ] Engram or Impulse README (name it)
+- [ ] SDK reference (Go examples)
+- [ ] Website / tutorials / blog
+- [ ] Community health file (Code of Conduct, Security, Support, etc.)
+
+## What needs to change?
+Link to the existing page/file and tell us what is missing or incorrect.
+
+## Source of truth
+Add the CRD, code snippet, or log output that proves the correct behaviour so we can update the doc with confidence.
+
+## Suggested fix (optional)
+Share wording, diagrams, or commands that would resolve the issue.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,33 @@
+---
+name: "Feature request"
+about: "Pitch a new capability for the operator, transport, SDK, Engram, or docs"
+labels: ["kind/feature", "status/triage"]
+---
+
+## Problem statement
+What workflow or operational gap are you trying to solve? Include scale, latency, tenancy, or compliance constraints if relevant.
+
+## Proposed change
+Describe the behaviour you’d like to see. If this affects CRDs, Engram templates, or SDK APIs, list the new fields and defaults.
+
+```
+apiVersion: catalog.bubustack.io/v1alpha1
+kind: EngramTemplate
+spec:
+  with:
+    newField: ...
+```
+
+## Affected component(s)
+- [ ] bobrapet
+- [ ] bobravoz-grpc
+- [ ] bubu-sdk-go
+- [ ] Engram (name it)
+- [ ] Impulse (name it)
+- [ ] Docs / website
+
+## Alternatives considered
+What did you try already? Examples: custom Engram, Go Templates, external controller, different transport, etc.
+
+## Additional context
+Links, design docs, screenshots, or related issues/discussions.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,33 @@
+## Summary
+<!-- What does this PR change and why? -->
+
+## Type of change
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Breaking change
+- [ ] Documentation / examples
+- [ ] Refactor / chore
+
+## Related issues
+<!-- Link issues (e.g., Fixes #123) -->
+
+## How was this tested?
+- [ ] Unit tests
+- [ ] Integration tests
+- [ ] E2E / Kind tests
+- [ ] Manual verification
+Commands / notes:
+```bash
+# paste commands you ran (or explain why not)
+```
+
+## Docs / CRDs impact
+- [ ] Docs updated (README/Guides/Support)
+- [ ] CRD or Engram/Impulse schema changes
+- [ ] Not applicable
+
+## Checklist
+- [ ] Lint/tests ran locally
+- [ ] Updated Engram.yaml/CRDs/manifests when behaviour changed
+- [ ] Added changelog/release note if required
+- [ ] No secrets or sensitive data committed

.github/dependabot.yml

@@ -0,0 +1,50 @@
+version: 2
+updates:
+  # Go module dependencies
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    groups:
+      kubernetes:
+        patterns:
+          - "k8s.io/*"
+          - "sigs.k8s.io/*"
+      opentelemetry:
+        patterns:
+          - "go.opentelemetry.io/*"
+      grpc:
+        patterns:
+          - "google.golang.org/grpc"
+          - "google.golang.org/protobuf"
+      bubustack:
+        patterns:
+          - "github.com/bubustack/*"
+    labels:
+      - "dependencies"
+      - "go"
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "github-actions"
+
+  # Docker base images
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "docker"
+

.github/labels.yml

@@ -0,0 +1,75 @@
+- name: "kind/bug"
+  color: "d73a4a"
+  description: "Unexpected behaviour or regression that needs fixing."
+- name: "kind/feature"
+  color: "0e8a16"
+  description: "New functionality or enhancement request."
+- name: "kind/docs"
+  color: "c5def5"
+  description: "Documentation, examples, or community health updates."
+- name: "kind/refactor"
+  color: "5319e7"
+  description: "Code health, cleanup, or non-functional improvements."
+- name: "kind/tests"
+  color: "fbca04"
+  description: "Testing, CI, or verification-only changes."
+- name: "kind/chore"
+  color: "bfd4f2"
+  description: "Maintenance, dependency bumps, or release automation."
+- name: "dependencies"
+  color: "0366d6"
+  description: "Dependency updates raised by automation such as Dependabot."
+- name: "area/operator"
+  color: "0b4f6c"
+  description: "Bobrapet controller or CRD-level change."
+- name: "area/transport"
+  color: "0b4f6c"
+  description: "Bobravoz gRPC transport changes."
+- name: "area/sdk"
+  color: "0b4f6c"
+  description: "Bubu SDK or shared runtime work."
+- name: "area/engram"
+  color: "0b4f6c"
+  description: "Specific Engram implementation or template change."
+- name: "area/impulse"
+  color: "0b4f6c"
+  description: "Impulse templates, webhook ingestion, or trigger paths."
+- name: "area/docs"
+  color: "0b4f6c"
+  description: "Docs site, READMEs, or knowledge base updates."
+- name: "priority/critical"
+  color: "b60205"
+  description: "Production-impacting issue that needs immediate attention."
+- name: "priority/high"
+  color: "d93f0b"
+  description: "Important issue to schedule soon."
+- name: "priority/medium"
+  color: "fbca04"
+  description: "Normal priority item."
+- name: "priority/low"
+  color: "cfd3d7"
+  description: "Nice-to-have or backlog item."
+- name: "status/triage"
+  color: "ededed"
+  description: "Issue has not been reviewed yet."
+- name: "status/needs-info"
+  color: "f9d0c4"
+  description: "Waiting on more information from the reporter."
+- name: "status/in-progress"
+  color: "004d99"
+  description: "Actively being worked on."
+- name: "status/blocked"
+  color: "5319e7"
+  description: "Blocked on another issue, dependency, or external signal."
+- name: "status/ready"
+  color: "28a745"
+  description: "Ready to merge/release once tests pass."
+- name: "good first issue"
+  color: "7057ff"
+  description: "Small, well-scoped tasks for new contributors."
+- name: "help wanted"
+  color: "008672"
+  description: "Looking for community contributions."
+- name: "triage/needs-owner"
+  color: "5319e7"
+  description: "Needs someone to own or shepherd the fix."