feat(grounding): attach the repo-search tools and reground the prompt

[EdmondDantes21]

Fleet rollout of the new grounding path. Server side: krateo-autopilot#34. Pin data: krateo-installer#232.

What changes for the clickstack agent

It stops fetching a pinned docs/llms.txt URL and starts grepping its own component at the version this cluster runs. krateo-repo-mcp-server (a shared RemoteMCPServer, deployed by the autopilot chart) resolves every ref from the installer's component pins, so a version is a tool read rather than a recollection.

File	Change
templates/agent.yaml	the six repo tools (get_deployed_versions, list_krateo_repos, list_krateo_blueprints, list_repo_files, search_repo, read_repo_file), gated on repoSearch.enabled exactly like the existing fetch block
values.yaml	repoSearch: {enabled: true, mcpServer: krateo-repo-mcp-server}
values.schema.json	the matching strict entry — mandatory, the root is additionalProperties: false
files/prompts-eng.yaml	grounding, ## Tools, and the ## Your component footer rewritten

The prompt

• Grep first, cite always. search_repo returns up to 100 path:line hits in one call; every claim carries the repo/path:line it came from. "No matches" is an honest answer, not a licence to answer from memory.
• Versions come from the tool. get_deployed_versions(), never recall. The tools already default to the deployed pin, so ref= is passed only to compare releases.
• Pagination retargeted. read_repo_file prints lines X-Y of Z and hands back an offset — replacing the old 5000-char start_index advice, and the silent-truncation failure it enabled.
• The footer names krateo-otel-collector alongside the chart repo, and points at the observability components.
• fetch stays wired and enabled, narrowed to URLs outside the corpus (upstream docs, a release note, an issue). docs/llms.txt survives as the curated index — now read with read_repo_file at the deployed pin, which also keeps AGENTS-VERSIONING §10's DOC-D2 rule satisfied.

Verification

Live on installer-e2e-test-2 (chart pushed to a scratch registry and the CD repointed): the agent is Accepted=True with all six tools in discoveredTools, its pod is healthy, and its prompt ConfigMap contains no __DOC_TAG__ and no raw.githubusercontent URL. helm template/lint clean with the flag on and off, and hack/lint-agents.py is unchanged from baseline.

Not in this PR: Chart.yaml (local version bumps) and .tgz packages. The pin bump belongs in the installer once this is tagged.

🤖 Generated with Claude Code