feat: add edgenode-harvester container variant

[evangineer]

Summary

• Introduces Dockerfile.harvester — a new edge node container variant that bundles log-harvester (unytco/log-harvester) instead of log-sender, for Unyt invoice aggregation
• unyt.happ is baked in from the latest unytco/unyt-sandbox release (pinnable via UNYT_HAPP_VERSION build arg)
• Self-contained s6-overlay-harvester/ service tree manages conductor, log-harvester, logrotate-cron, and setup
• Dockerfile.log-collector added — our Dockerfile for the unytco/log-collector Cloudflare Worker, used in CI and local integration testing
• CI job build-and-push-harvester-image publishes ghcr.io/holo-host/edgenode-harvester on release; requires HARVESTER_REPO_TOKEN secret (PAT with repo read access to unytco/log-harvester and unytco/log-collector)
• docker-compose.yml updated with edgenode-harvester service and restart: unless-stopped on log-collector
• New LOG_HARVESTER_QUICKSTART.md and updated README.md, docker/README.md, docker/CHANGELOG.md, docker/TESTING.md

Architecture

log-collector (Cloudflare Worker)
  → edgenode-harvester (this container)
      ├── Holochain conductor (admin: 4444, app: 4445)
      ├── unyt.happ (installed at first startup)
      └── log-harvester (Node.js, daily loop)
            → Unyt Agreements (parked spend invoices)

Notable fixes

• Config path moved from /etc/log-harvester to /data/log-harvester so it survives restarts on the volume-mounted path; drops the now-redundant holo-config-harvester volume
• s6 shebangs fixed to #!/command/with-contenv so HC_* env vars are visible inside services
• log-harvester source is pre-cloned via actions/checkout in CI (and git clone locally by run_harvester_tests.sh) then COPY'd into the image — no build-time secrets needed in the Dockerfile
• GHA layer caching added to PR checks for edgenode, edgenode-harvester, and log-collector builds
• Test runner isolation — run_tests_multi.sh runs each .bats file individually with a log-collector health-check wait between files, so a wrangler dev crash in one file doesn't cascade to subsequent files

Test suite

Four BATS files run via ./run_harvester_tests.sh (builds image, starts all services, waits for readiness):

File	What it tests
harvester_startup.bats	Conductor ready, unyt.happ installed, config initialized, service started
harvester_process.bats	Holochain and Node.js run as nonroot
harvester_integration.bats	Connectivity — harvester reaches log-collector, /logs returns success
harvester_e2e.bats	Full pipeline — log-sender submits signed metrics → D1 → harvester fetches and invoices (--today --dry-run), asserts "Successfully invoiced logs."

Test plan

• Built locally — clean build
• 11/11 harvester tests pass (run_harvester_tests.sh)
• All CI checks pass (test-docker-image and test-harvester-image)
• Confirm HARVESTER_REPO_TOKEN secret is set in repo Actions secrets before merging (required for CI build)
• Run docker compose up edgenode-harvester with valid COLLECTOR_URL, ADMIN_SECRET, LAIR_PASSWORD and verify harvester reaches "Starting log-harvester service..." in startup log
• Verify lastInvoice is preserved across a container restart

🤖 Generated with Claude Code