Upgrade to v0.6: flags and variables become one file

v0.6.0 removed every flag and environment variable of the server binaries and jobs, with no aliases. One validated configuration file replaces them (0063). The tables map each old name to its key. The keys are the file's version 1. v0.13 reads them for one more minor and expects version 2's ...Secret names (the v0.13 upgrade). A flag with no variable is listed with its flag only.

audit-writer

was	now
--mode, AUDIT_MODE	mode
--listen, AUDIT_LISTEN	listen.address
--deployment, AUDIT_DEPLOYMENT	deployment
--workloads, AUDIT_WORKLOADS	workloads
--anonymous-writes	anonymousWrites: true
--catalogues, AUDIT_CATALOGUES	catalogues
--replicas, AUDIT_REPLICAS	replicas
--database, AUDIT_DATABASE	database.url, with the password in database.passwordEnv rather than the URL
--bucket, AUDIT_BUCKET	archive.bucket.name
--prefix, AUDIT_PREFIX	archive.prefix
--region, AWS_REGION	archive.bucket.region
--endpoint, AUDIT_S3_ENDPOINT, AWS_ENDPOINT_URL_S3	archive.bucket.endpoint
--path-style, AUDIT_S3_PATH_STYLE	archive.bucket.pathStyle
--lock-mode, AUDIT_LOCK_MODE; --governance	archive.lockMode (governance for the flag)
--kms-key, AUDIT_KMS_KEY	archive.kmsKey
AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY	archive.bucket.credentialsEnv, naming the variables. Unset still means the SDK's ambient credentials
--key-provider, AUDIT_KEY_PROVIDER	keys.provider
--key-root, AUDIT_KEY_ROOT	keys.local.rootFile
--key-dir, AUDIT_KEY_DIR	keys.local.dir
--keep-identities (default true)	forgetIdentities (default false): the sense is reversed
--transit-prefix, AUDIT_TRANSIT_PREFIX	keys.transit.prefix
--transit-address, AUDIT_TRANSIT_ADDRESS, BAO_ADDR, VAULT_ADDR	keys.transit.openbao.address
--transit-mount, AUDIT_TRANSIT_MOUNT	keys.transit.openbao.mount
--transit-namespace, AUDIT_TRANSIT_NAMESPACE, BAO_NAMESPACE, VAULT_NAMESPACE	keys.transit.openbao.namespace
--transit-ca-file, AUDIT_TRANSIT_CA_FILE, BAO_CACERT, VAULT_CACERT	keys.transit.openbao.caFile
--transit-auth-mount, --transit-auth-role, --transit-jwt-file (and their AUDIT_TRANSIT_*)	keys.transit.openbao.login.mount, .role, .jwtFile
--transit-token-file, AUDIT_TRANSIT_TOKEN_FILE	keys.transit.openbao.tokenFile
BAO_TOKEN, VAULT_TOKEN	keys.transit.openbao.tokenEnv, naming a variable of your choosing. The two names are no longer read
--stream-url, AUDIT_STREAM_URL	stream.nats.url
--stream, AUDIT_STREAM	stream.name
--stream-token-file, AUDIT_STREAM_TOKEN_FILE	stream.nats.tokenFile
--consumer, AUDIT_CONSUMER	stream.consumer
--stream-batch, AUDIT_STREAM_BATCH	stream.batch
--stream-ack-wait	stream.ackWait
--roll-interval	roll.interval
--roll-max-records, AUDIT_ROLL_MAX_RECORDS	roll.maxRecords
--version, AUDIT_VERSION	removed: the observer version is the build's own. --version still prints it

audit-query

was	now
--listen, AUDIT_LISTEN	listen.address
--searcher, AUDIT_SEARCHER	searcher
--database, AUDIT_DATABASE	database.url and database.passwordEnv
--grants, AUDIT_GRANTS	grants
--deployment, AUDIT_DEPLOYMENT	deployment
--sink, AUDIT_SINK	sink.url
AUDIT_TOKEN_FILE	sink.tokenFile
--bucket, --prefix, --endpoint, --path-style and their variables	archive.bucket.name, archive.prefix, archive.bucket.endpoint, archive.bucket.pathStyle
AUDIT_REGION, AWS_REGION	archive.bucket.region
--exports, AUDIT_EXPORTS	exports.bucket.name
--exports-endpoint, AUDIT_EXPORTS_ENDPOINT; --exports-path-style, AUDIT_EXPORTS_PATH_STYLE	exports.bucket.endpoint, .pathStyle. The exports bucket no longer inherits the archive's: name them
AUDIT_EXPORTS_ACCESS_KEY_ID, AUDIT_EXPORTS_SECRET_ACCESS_KEY, AUDIT_EXPORTS_SESSION_TOKEN	exports.bucket.credentialsEnv.accessKeyID, .secretAccessKey, naming the variables. A session token is not carried: use ambient credentials
--export-expiry, --export-link-valid	exports.expiry, exports.linkValid
--key-provider and the other key flags	keys, as for the writer. The provider turns resolve on
--version, AUDIT_VERSION	removed

The jobs

was	now
--deployment, AUDIT_DEPLOYMENT	deployment
--bucket, --prefix, --region, --endpoint, --path-style, --lock-mode	archive.bucket.name, archive.prefix, archive.bucket.region, .endpoint, .pathStyle, archive.lockMode
--sink, AUDIT_SINK	sink.url; AUDIT_TOKEN_FILE becomes sink.tokenFile
--instance	removed: the job names itself
verify --profile (repeatable)	profiles
verify --last	last
verify --public-key, --lookback, --record	removed with the v1 layout: verify needs no key
purge --database	database.url and database.passwordEnv
purge --identifying-after, --dedupe-window	identifyingAfter, dedupeWindow
clock-sync --ntp (repeatable), --max-offset, --timeout	ntp, maxOffset, timeout
migrate --database, --reader	database, reader (and writer, observe, purge, new)

--dry-run of audit purge, and --from and --to of audit verify, remain on the command line for a person: they are not scheduled work and have no key.

Chart values

was	now
bucket, prefix, region, kmsKey, lockMode	writer.config.archive.bucket.name, .prefix, .bucket.region, .kmsKey, .lockMode; the same under the query service's and each job's archive
governance: true	archive.lockMode: governance
endpoint, pathStyle	archive.bucket.endpoint, .pathStyle
existingSecret (S3 keys)	archive.bucket.credentialsEnv and a secretEnv entry per variable
anonymousWrites	writer.config.anonymousWrites
database.url, database.existingSecret	writer.config.database.url and passwordEnv, with the password in writer.secretEnv; the same for receiver, migrate and jobs.purge
database.migrate	migrate.enabled, with migrate.config.database
query.database.*	query.config.database with query.secretEnv; query.database.role is migrate.config.reader
query.exports.bucket, .expiry, .linkValid, .endpoint, .pathStyle, .existingSecret	query.config.exports.bucket.name, .expiry, .linkValid, .bucket.endpoint, .pathStyle, .bucket.credentialsEnv
query.searcher	query.config.searcher
query.resolve.*	query.config.keys, and query.keysVolume for the local provider
keys.provider	writer.config.keys.provider
keys.local.existingSecret	writer.secretMounts and keys.local.rootFile
keys.local.persistence	keysVolume, and keys.local.dir: /var/lib/audit/keys
keys.transit.prefix	keys.transit.prefix
keys.transit.role, openbao.auth.mount, .audience, .expirationSeconds	keys.transit.openbao.login.mount, .role, .jwtFile, with a tokens entry of that audience and expirationSeconds
keys.transit.token.existingSecret, .tokenFile	openbao.tokenEnv with secretEnv, or openbao.tokenFile with secretMounts
openbao.address, .mount, .namespace	keys.transit.openbao.address, .mount, .namespace
stream.url, .name, .consumer, .batch, .ackWait	stream.nats.url, .name, .consumer, .batch, .ackWait in writer.config and receiver.config
stream.token.enabled, .audience, .expirationSeconds	a tokens entry on receiver and writer, and stream.nats.tokenFile
roll.interval, roll.maxRecords	writer.config.roll.interval, .maxRecords
workloadIdentity.expirationSeconds	expirationSeconds of each component's tokens entry
jobs.verify.publicKey.*, .window	jobs.verify.config.last (no key: verify reads the archive only)
jobs.digest.*	removed with the v1 layout: the digest job read the v0 layout. jobs.notary replaces it (audit-notary, its own image, signer with a P-384 key)
jobs.purge.identifyingAfter, .dedupeWindow	jobs.purge.config.identifyingAfter, .dedupeWindow
jobs.clockSync.ntp, .maxOffset	jobs.clockSync.config.ntp, .maxOffset
telemetry.*	OTEL_* environment, set on the pods by the platform
trust, catalogues, profiles, workloadIdentity, extensions, networkPolicy, mode, replicas, writer.consumers	unchanged

The verify job is one CronJob, <fullname>-verify, covering the profiles in its profiles or every profile. A query service's region comes from archive.bucket.region. A store that needs S3 static credentials names the variables in credentialsEnv, and the chart puts only those into the pod. Other changes are in the CHANGELOG.