feat(multiplayer): wire allocated fleet runtime

deploy/k8s/base/fleet.yaml

@@ -17,6 +17,11 @@ spec:
         cosmic-clash.io/build: build-1
         cosmic-clash.io/protocol: "1"
         cosmic-clash.io/transport: enet
+      annotations:
+        # The release process replaces this with the immutable image digest;
+        # the Downward API passes the same value to the supervisor so the
+        # allocated child can validate its assignment manifest.
+        cosmic-clash.io/image-digest: sha256:0000000000000000000000000000000000000000000000000000000000000000
     spec:
       ports:
         - name: game
@@ -49,7 +54,49 @@ spec:
           containers:
             - name: game-server
               image: ghcr.io/cosmic-clash/game-server@sha256:0000000000000000000000000000000000000000000000000000000000000000
-              args: ["--port=7777"]
+              args:
+                - --sdk-base-url=http://127.0.0.1:9357
+                - --ready-url=http://127.0.0.1:7780/ready
+                - --drain-url=http://127.0.0.1:7780/drain
+                - --drain-token-env=COSMIC_CLASH_DRAIN_TOKEN
+                - --control-plane-url=http://control-plane.cosmic-clash.svc.cluster.local:8080
+                - --server-id-env=COSMIC_CLASH_SERVER_ID
+                - --image-digest-env=COSMIC_CLASH_IMAGE_DIGEST
+                - --roster-path=/run/cosmic-clash/join-roster.json
+                - --transport=enet
+                - --
+                - --allocated-mode
+                - --match-id=allocation-placeholder
+                - --server-id=allocation-placeholder
+                - --playlist-version=casual
+                - --client-build=build-1
+                - --assignment-expiry-unix=1
+                - --server-image-digest=sha256:0000000000000000000000000000000000000000000000000000000000000000
+                - --transport=enet
+                - --region=EU
+                - --join-authorisations-file=/run/cosmic-clash/join-roster.json
+                - --join-authorisations-key-file=/run/secrets/cosmic-clash/join-signing-key
+                - --readiness-port=7780
+              env:
+                - name: COSMIC_CLASH_SERVER_ID
+                  valueFrom:
+                    fieldRef:
+                      fieldPath: metadata.name
+                - name: COSMIC_CLASH_IMAGE_DIGEST
+                  valueFrom:
+                    fieldRef:
+                      fieldPath: metadata.annotations['cosmic-clash.io/image-digest']
+                - name: COSMIC_CLASH_DRAIN_TOKEN
+                  valueFrom:
+                    secretKeyRef:
+                      name: cosmic-clash-game-server
+                      key: drain-token
+              volumeMounts:
+                - name: allocated-roster
+                  mountPath: /run/cosmic-clash
+                - name: join-signing-key
+                  mountPath: /run/secrets/cosmic-clash
+                  readOnly: true
               securityContext:
                 allowPrivilegeEscalation: false
                 readOnlyRootFilesystem: true
@@ -62,3 +109,12 @@ spec:
                 limits:
                   cpu: 1
                   memory: 512Mi
+          volumes:
+            - name: allocated-roster
+              emptyDir: {}
+            - name: join-signing-key
+              secret:
+                secretName: cosmic-clash-game-server
+                items:
+                  - key: join-signing-key
+                    path: join-signing-key