K2GO-444 refactor: ship code_addons as an overlay

controller/docs/ADR-addons-offline-gallery.md

@@ -124,11 +124,14 @@ place is a separate, deliberate change (K2GO-440).
 
 ### How the role is added (upstream-patches)
 
-The role ships as a new `tools/upstream-patches` patch, the same mechanism as
-`0003-forgejo-add-role-4505.patch`: it adds `roles/<addons>/*` plus the variable wiring
-(`default_vars.yml`, `local_vars_android_{small,medium,large}.yml`, `local_vars_large.yml`), the
-`0-init` validations, and the `6-generic-apps` include. It ships `install`/`enabled` False by
-default; the K2Go bake flips them per tier.
+The role is carried as a whole-file overlay under
+`tools/upstream-patches/overlays/roles/code_addons/`, like `code_assets` (K2GO-437), not a
+unified-diff patch (K2GO-444): the files are all new, so an overlay is deterministic and never drifts
+against a moving upstream. Because an overlay cannot add the `6-generic-apps` include, the role has no
+auto-include: the main install does not run it. It is run on demand via `runrole code_addons`. The
+role tree is present on every tier (the overlay is not tier-gated), so on-demand install works
+anywhere; `iiab-android` enables and mirrors it at bake for Standard and Full, not Basic (the mirror
+pulls a large set of `.cgp` files).
 
 ### Load-bearing guards (what must not regress)
 

iiab-android

@@ -645,9 +645,11 @@ else
       ;;
   esac
 
-  # K2GO-99: the code_addons role (offline Code on the Go add-ons gallery) ships install/enabled
-  # False in every vars template (carried via tools/upstream-patches), so enable it for Standard/Full
-  # here, not Basic: the mirror pulls a large set of .cgp files (hundreds of MB).
+  # K2GO-99 / K2GO-444: the code_addons role (offline Code on the Go add-ons gallery) ships as an
+  # overlay (tools/upstream-patches/overlays), so the role tree is present on every tier but it has NO
+  # 6-generic-apps include: the main install does not run it. It is run on demand via runrole (the
+  # post-install step below does the bake-time mirror). Enable it for Standard/Full here, not Basic:
+  # the mirror pulls a large set of .cgp files (hundreds of MB).
   case "$LOCAL_VARS_URL" in
     *_small*)
       log "Basic tier: Code on the Go add-ons left off."
@@ -702,6 +704,24 @@ fi
 bash "$tmp_install" "$@"
 rm -f "$tmp_install"
 
+#-----------------------------
+# K2GO-444: mirror and serve the Code on the Go add-ons gallery (Standard and Full). The code_addons
+# role ships as an overlay with no 6-generic-apps include, so the main install does not run it; run it
+# here via runrole (the same path the app uses for on-demand installs). Needs internet, which the bake
+# has. Non-fatal: a failure leaves the box without the add-ons gallery but does not fail the bake.
+#-----------------------------
+case "$LOCAL_VARS_URL" in
+  *_small*)
+    log "Basic tier: Code on the Go add-ons gallery left off."
+    ;;
+  *)
+    if is_role_enabled code_addons; then
+      log "Mirroring Code on the Go add-ons gallery (runrole code_addons)..."
+      ( cd /opt/iiab/iiab && ./runrole code_addons ) || warn "code_addons runrole failed; box will lack the add-ons gallery"
+    fi
+    ;;
+esac
+
 #-----------------------------
 # K2GO-437: mirror and serve the Code on the Go build assets (Full only). The code_assets role ships
 # as an overlay with no 6-generic-apps include, so the main install does not run it; run it here via

tools/upstream-patches/overlays/roles/code_addons/defaults/main.yml

@@ -0,0 +1,22 @@
+# code_addons_install: True
+# code_addons_enabled: True
+
+# Offline mirror of the Code on the Go add-ons gallery (plugins, templates,
+# snippets, code-actions). Sibling of the 'code' role: a static site served by
+# NGINX, no daemon, no database. The gallery is browsed at http://box/code-addons
+# and each add-on downloads from http://box/code-addons/dl/<slug>.cgp.
+# Design: controller/docs/ADR-addons-offline-gallery.md (K2GO-99).
+
+# The published gallery to mirror from (the public R2 site). The role follows
+# references from index.html and v1/catalog.json, so it needs no file list: a new
+# add-on or a new shell asset is picked up on the next (re)install.
+# TO UPDATE a deployed box without a re-bake, dash-node re-runs the same mirror
+# in-server; a re-bake or 'runrole --reinstall code_addons' re-mirrors here.
+code_addons_source_base: "https://addons.appdevforall.org"
+
+# Local serve path. The catalog base is rewritten to this, so the gallery works
+# at http://<box-address>/code-addons/ with no host baked into the files.
+code_addons_url: /code-addons
+
+# Served document root (static files, like roles/code).
+code_addons_serve_path: "{{ content_base }}/www/code-addons"   # /library/www/code-addons