fix: provision v6 keys before a v5 to v6 upgrade

tests/lasuite-docs/install_steps.sh

@@ -21,23 +21,22 @@ set -euo pipefail
 ENV_PATH="${CCCI_APP_ENV:?missing}"
 
 # The v6 release requires two RSA PEM secrets with generate=false. CI must
-# supply those operator-managed keys for the published base recipe; a PR head
-# that provides its own keys still runs without these secrets after upgrade.
-RECIPE_DIR="${ABRA_DIR:-$HOME/.abra}/recipes/lasuite-docs"
-if grep -qE '^[[:space:]]{2}(jwt_pk|yhub_jwt_pk):' "$RECIPE_DIR/compose.yml"; then
-  STACK_NAME="${CCCI_APP_DOMAIN//./_}"
-  for SECRET_NAME in jwt_pk yhub_jwt_pk; do
-    ENV_NAME="SECRET_${SECRET_NAME^^}_VERSION"
-    VERSION=$(sed -n "s/^${ENV_NAME}=\([^ #]*\).*/\1/p" "$ENV_PATH" | tail -1)
-    : "${VERSION:?missing $ENV_NAME}"
+# supply those operator-managed keys before deploy, including when the base
+# is v5 and the upgrade head is v6. A PR head with its own key sidecar ignores
+# these secrets after upgrade.
+STACK_NAME="${CCCI_APP_DOMAIN//./_}"
+for SECRET_NAME in jwt_pk yhub_jwt_pk; do
+  ENV_NAME="SECRET_${SECRET_NAME^^}_VERSION"
+  VERSION=$(sed -n "s/^${ENV_NAME}=\([^ #]*\).*/\1/p" "$ENV_PATH" | tail -1)
+  if [ -n "$VERSION" ]; then
     DOCKER_SECRET="${STACK_NAME}_${SECRET_NAME}_${VERSION}"
     if ! docker secret inspect "$DOCKER_SECRET" >/dev/null 2>&1; then
       openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 2>/dev/null \
         | docker secret create "$DOCKER_SECRET" - >/dev/null
       echo "  install_steps: supplied ${SECRET_NAME} for the published base recipe"
     fi
-  done
-fi
+  fi
+done
 
 # No deps file / no keycloak entry → install-time provisioning failed or was skipped. NO-OP so the
 # recipe still boots; the @requires_deps OIDC custom test then SKIPs and F2-11 flips the run RED.