Implement RFC-0003 local storage: node-local (Option C, single-node) + drop chmod 777

[saadqbal]

Implementation of the RFC-0003 decisions (design: backend#1151, RFC doc: tracebloc/cli#366).

Goal (from Asad + Lukas): deleting the cluster must destroy the dataset data, and data must not sit as a browsable folder in ~/.tracebloc. It should live inside the cluster's own sandbox.

Decision landed: Option C — node-local storage via k3s built-in local-path, on a single-node local cluster (C1: AGENTS=0). Plus drop the chmod 777 on data dirs (RFC §7.3).

Prototype: #368 (draft, flag-gated TB_STORAGE_MODE=node-local).

Scope (this repo — client)

• 7.3 — drop chmod 777: not a standalone PR — on the hostpath model it's load-bearing (host-user writes to /data/shared + no fsGroup on hostPath volumes). node-local removes the host dirs entirely, so 777 is gone by construction. Folded into feat(installer): node-local storage prototype (RFC-0003 Option C, flag-gated) #368.
• Option C storage (behind TB_STORAGE_MODE, default hostpath unchanged) — feat(installer): node-local storage prototype (RFC-0003 Option C, flag-gated) #368:
  • Installer values: storageClass.create=false + name=local-path; hostPath.enabled=false; keep pvcAccessMode=ReadWriteOnce.
  • Drop the -v ${HOST_DATA_DIR}:/tracebloc@all bind-mount; keep k3s local-storage (was --disabled).
  • Skip _ensure_tracebloc_dirs / _ensure_release_dirs host-dir pre-create + chmod in node-local.
  • C1: node-local forces AGENTS=0 (single-node).
  • mysql privileged chown init-container auto-drops when hostPath.enabled=false (confirmed via helm template).
• Regenerate installer manifest (scripts/gen-manifest.sh → scripts/manifest.sha256).

Verification

• helm template node-local → 0 hostPath PVs, PVCs bind local-path, no mysql init (verified on Mac; hostpath contrast = 3 PVs + init present).
• local-path StorageClass present + PVC binds + pod mounts (live k3d).
• Data not under ~/.tracebloc — lives in the node's Docker volume (inside the Docker VM on macOS).
• cluster stop && start → data survives (restart-persistence).
• cluster delete → node + Docker volume removed, data gone (delete-persistence) — re-confirmed on the real credentialed install (CSVs + MySQL .ibd present before, destroyed after).
• Fixed: node-local no longer creates empty 777 host dirs (second _ensure_tracebloc_dirs call site gated — commit 5e4ea45).
• Credentialed install + real spawned workload → node-local install on dev; ingested train(120)/test(40); each ran as a real jobs-manager ingest-job mounting client-pvc on the single node. Full backend training experiment deferred — blocked on a dev-account /dataset/admin/ 401, orthogonal to storage.
• Existing hostpath install upgrade (--reuse-values) still works, no silent migration.

Follow-up (other repo — cli)

• internal/cli/delete.go: add verify-before-✔ on the host-data removal; the elaborate multi-path wipe from RFC §3.3 is unnecessary under C.

Migration (RFC §7.5)

autoUpgrade uses helm upgrade --reuse-values, so existing installs keep hostPath.enabled=true and do NOT silently migrate — they move to C only on a clean delete + reinstall. No data-copy tool; keep the leftover-guard so nothing is silently stranded.

---

D15 — default-flip (decided 2026-07-22, RFC v2.2 §10)

Node-local becomes the default for local installs. Checklist:

• Default TB_STORAGE_MODE=node-local for local installs (hostpath stays available as an explicit opt-out)
• AGENTS default → 0 for local installs (single-node; override still honored, C1 constraint documented)
• Document the TB_STORAGE_MODE=hostpath escape hatch
• Release notes: storage change + single-node default topology + "delete means gone"
• Gate: one green end-to-end training run on a node-local dev install — currently blocked by tracebloc/backend#1180

Leftover-guard (D3) tracked separately: #376. Epic: tracebloc/backend#1151.