declare Garden tooling and workbench

docs/plans/workflow-system.md

@@ -13,9 +13,9 @@ and add no abstraction without a demonstrated repeated need.
 - Branch: `chore/workflow-system`
 - Baseline: `nix flake check --no-build --quiet` passed on 2026-09-05; only
   the existing dirty-tree and unknown `modules` output warnings were emitted.
-- Next: prove the common contract in `rules-service`, `yookr-api`, and
+- Next: activate the Nix-owned Garden tools on Zenith and run the credentialed
-  `traceability-data-model`; the service pilots are checkpointed, so preserve
+  `just k8s test` workbench gate over the VPN. Then prove named database
-  and reconcile the schema repository's existing WIP next.
+  connections and one Marimo-to-HTML report before expanding the workbench.
 
 ## Progress
 
@@ -23,7 +23,7 @@ and add no abstraction without a demonstrated repeated need.
 | --- | --- | --- |
 | Bootstrap and repository ownership | Waiting for user | Repository and dashboard reconciliation complete; credential cleanup remains |
 | Declarative workstation foundation | Complete | All-host builds pass with one Nixpkgs pin, `just`, and an explicit Podman Compose provider |
-| Repository contracts and workbench | Active | Service contracts checkpointed; API empirical gates and schema pilot remain |
+| Repository contracts and workbench | Active | Three contracts and the local workbench are checkpointed; credentialed empirical gates remain |
 | Desktop, agents, notes, PIM, transcription | Pending | Independent pilots follow foundation changes |
 | Conditional retirement and completion | Pending | Requires per-pilot evidence |
 
@@ -36,6 +36,8 @@ and add no abstraction without a demonstrated repeated need.
 | `yookr-dashboard-new` | `feat/gogv2` | `934605d` | Remove obsolete dashboard converter |
 | `rules-service` | `chore/workflow-contract` | `555d9cd` | Establish the first common repository contract |
 | `yookr-api` | `chore/workflow-contract` | `a76b2b7` | Establish the HTTP and OpenAPI contract |
+| `traceability-data-model` | `chore/workflow-contract` | `33cb7ff` | Establish the database and schema contract |
+| `yookr-workbench` | `main` | `6aae6d5` | Create the local-only cross-system workbench |
 
 ## Human actions
 
@@ -53,6 +55,11 @@ and add no abstraction without a demonstrated repeated need.
   `just openapi-refresh test`; the current test deployment returns 404.
 - Populate the ignored API HTTP credentials and perform the planned login plus
   harmless administrator read; no credential-bearing request has been made.
+- Activate the Nix-owned Garden tools, verify `gardenctl` and `gardenlogin`,
+  then remove their duplicate binaries from `~/.garden` and `~/.local/bin`.
+- With the VPN active, run `just k8s test` in `yookr-workbench` and confirm the
+  test shoot opens read-only; this credentialed interactive gate has not been
+  run automatically.
 - Destructive cleanup, credentials, activation, and empirical pilot decisions
   will be surfaced here before use.
 
@@ -103,4 +110,17 @@ and add no abstraction without a demonstrated repeated need.
   through both anonymous HTTPS and the working SSH identity. The test service
   is reachable, but its currently deployed GET image returns 404 for the full
   OpenAPI route already present in local source and ingress configuration.
+- `traceability-data-model` preserves the existing domain/schema redesign while
+  replacing automatic schema recreation with explicit `just reset`. Ordinary
+  `just dev` retains its Compose volumes, and the flake check loads fixtures in
+  text-ID mode plus a fresh schema in UUID-ID mode. Both the built check and the
+  pinned `podman-compose` configuration validation pass.
+- Gardenctl 2.14.0 and Gardenlogin 0.10.0 are pinned from their official release
+  assets; the hashes match the existing binaries byte-for-byte. All three host
+  builds pass, the OIDC kubectl plugin is declarative, and Zsh now consumes the
+  native `gardenctl rc zsh` output.
+- The local-only `yookr-workbench` has no remote and initially owns only
+  `just k8s test`. Each invocation creates an isolated Garden session, rejects
+  every environment except test, and opens K9s read-only. Its flake check and
+  command catalog pass, and the live rejection path exits before Garden access.
 - Run independent pilots in parallel, but gate every retirement separately.

modules/capabilities/dev-tools.nix

@@ -2,6 +2,33 @@
 {
   flake.modules.homeManager.dev-tools =
     { config, pkgs, ... }:
+    let
+      gardenctl = pkgs.stdenvNoCC.mkDerivation {
+        pname = "gardenctl";
+        version = "2.14.0";
+        src = pkgs.fetchurl {
+          url = "https://github.com/gardener/gardenctl-v2/releases/download/v2.14.0/gardenctl_v2_linux_amd64";
+          hash = "sha256-JCZ0eJLgYbd2ZMCCWFlhX4vOhHKZL40oR2a3EZ3i4Q8=";
+        };
+        dontUnpack = true;
+        installPhase = ''
+          install -Dm755 "$src" "$out/bin/gardenctl"
+        '';
+      };
+      gardenlogin = pkgs.stdenvNoCC.mkDerivation {
+        pname = "gardenlogin";
+        version = "0.10.0";
+        src = pkgs.fetchurl {
+          url = "https://github.com/gardener/gardenlogin/releases/download/v0.10.0/gardenlogin_linux_amd64";
+          hash = "sha256-X4nHiZ29Mbnhxv/wlyD6PxX1KxzaX2R27N7Muu/gnH8=";
+        };
+        dontUnpack = true;
+        installPhase = ''
+          install -Dm755 "$src" "$out/bin/gardenlogin"
+          ln -s gardenlogin "$out/bin/kubectl-gardenlogin"
+        '';
+      };
+    in
     {
       home.sessionVariables.CARGO_HOME = "${config.xdg.dataHome}/cargo";
       home.packages = with pkgs; [
@@ -11,11 +38,14 @@
         posting
         resterm
         kubectl
+        kubelogin-oidc
         mongodb-compass
         scc
         nodejs
         mariadb
         just
+        gardenctl
+        gardenlogin
       ];
 
       programs.lazygit = {

modules/capabilities/shell.nix

@@ -7,10 +7,6 @@
       pkgs,
       ...
     }:
-    let
-      gardenctl = "${config.home.homeDirectory}/.garden/gardenctl";
-      uuidgen = lib.getExe' pkgs.util-linux "uuidgen";
-    in
     {
       home.sessionVariables = {
         STARSHIP_CACHE = "${config.xdg.cacheHome}/starship";
@@ -66,12 +62,7 @@
         '';
 
         initContent = ''
-          source <(${gardenctl} completion zsh)
+          source <(gardenctl rc zsh)
-          if [ -z "$GCTL_SESSION_ID" ] && [ -z "$TERM_SESSION_ID" ]; then
-            export GCTL_SESSION_ID=$(${uuidgen})
-          fi
-
-          eval $(${gardenctl} kubectl-env zsh)
 
           bindkey -v