feat(sms-bridge): select approved Messaging Service

[xnoto]

Summary

Selects the already published one-sender outbound path for opencode-sms-bridge:

• pins opencode-sms-bridge chart 0.1.3;
• pins compatible immutable bridge image commit tag 9ae1ead0f55c7040cdc7bdd3611718bc6b56cf62; and
• passes the owner-supplied, chart-defined non-secret Messaging Service identifier through config.messagingServiceSid.

This switches compatible worker replies from direct from_ sending to Twilio Messaging Service sending. The canonical inbound webhook URL, existing encrypted Secrets, routing/allowlist, PVC, Service, TunnelBinding, Argo policy, namespace, sync wave, and overlay source are unchanged.

Fixes #
N/A — owner-approved A2P sender-selection remediation.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — test run 34326470728 passed Kustomization-reference checks and pre-commit (including gitleaks and kube-linter) at c25baa5fd56db252576cc2c435079d6c4db54a4a.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — not applicable; the existing Application is the canonical consumer selection point.

Producer evidence already verified:

• images #44 published the compatible image after main build/push; its tests cover mutually exclusive Messaging Service/direct-sender arguments.
• charts #86 published chart 0.1.3 after main chart CI; it wires the non-secret value into the worker-only ConfigMap environment.
• tfroot-twilio #7 applied the Messaging Service and designated sender in main apply.

Adversarial and infrastructure-security reviews advanced this source change. The reviews record two accepted runtime dependencies: Campaign/sender association is owner-attested rather than repository-verifiable, and CI cannot prove the provider selects the intended sender. Repository CI also cannot render KSOPS/Helm OCI sources or prove Argo/runtime delivery; those remain post-merge verification gates. No local OpenTofu, Helm, SOPS, Kubernetes, or Twilio operation was run or claimed.

Impact and rollout

Producers: makeitworkcloud/images owns the bridge image; makeitworkcloud/charts owns chart rendering; makeitworkcloud/tfroot-twilio owns the Messaging Service/sender-pool declaration.

Consumer: this change is the final makeitworkcloud/kustomize-cluster selection gate at workloads/apps/opencode-sms-bridge-app.yaml. It introduces no Secret, SOPS/KSOPS generator, RBAC, network exposure, DNS, TunnelBinding, or Cloudflare change.

After a separately confirmed merge, test.yml runs on main; on success, sync.yml requests reconciliation of the App-of-Apps roots. It does not wait for reconciliation. Verify separately: gitops-workloads and opencode-sms-bridge selected revisions, Synced/Healthy state, resource tree, rendered ConfigMap/worker environment, Deployment/pods/events, and—only with separate approval—one controlled allowed-sender inbound-to-outbound delivery test confirming the Messaging Service sender.

Rollback: use a focused Git revert through normal CI/Argo reconciliation; do not manually patch, sync, or restart resources. The prior chart/image selection remains available as the known direct-sender rollback path.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints — the chart defines the Messaging Service identifier as non-secret ConfigMap material; no Secret changes.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes.

AI-assisted change: an OpenCode agent materially produced this change. Reviewers should verify the chart/image pins, non-secret worker-only configuration, unchanged inbound path, and remaining Twilio/Argo runtime gates.