feat(sandbox): pre-warm deno cache from S3 for deco site repos

[igoramf]

Summary

• Before running deno task dev, the daemon now attempts to download and extract the pre-built Deno module cache from S3 (<owner>/<repo>/cache.tar.zst) — the same path the admin build pipeline produces
• Non-fatal: if credentials aren't set or the object doesn't exist in S3, logs a message and continues normally (cold first run)
• Opt-in via the new decoSiteCache.secretName Helm value

Changes

packages/sandbox/daemon/setup/install.ts

• New trySpawnDecoSiteCache() — shell script that downloads <owner>/<repo>/cache.tar.zst from S3 and extracts into $DENO_DIR; credentials stay as $VAR references in the shell command (never in the command string or process list)

packages/sandbox/daemon/setup/orchestrator.ts

• stepInstall(): when spawnInstall returns null (deno case), calls trySpawnDecoSiteCache before marking install succeeded

packages/sandbox/image/Dockerfile

• Added zstd to apt-get install (required to decompress .tar.zst)

deploy/helm/sandbox-env/

• New optional decoSiteCache block in values.yaml + sandbox-template.yaml to inject DENO_DECO_CACHE_S3_* env vars from a K8s Secret

Activation

Create a K8s Secret with the S3 credentials and set in values.yaml:

decoSiteCache:
  secretName: deco-site-s3-cache
  region: sa-east-1
  bucket: deco-assets-storage

Test plan

• Deploy sandbox with decoSiteCache.secretName set — verify [deco-site cache] log appears and deno task dev starts faster
• Deploy without decoSiteCache.secretName — verify sandbox starts normally with no cache-related errors
• Deploy with invalid S3 credentials — verify [deco-site cache] s3 cache not available is logged and sandbox still starts

🤖 Generated with Claude Code

---

Summary by cubic

Speeds up the first deno task dev for deco-sites sandboxes by pre-warming the Deno module cache with a 15‑min pre‑signed S3 URL generated by mesh. No AWS credentials or Pod Identity are required in sandbox pods.

• New Features

  • Mesh reads DECO_CACHE_S3_BUCKET and DECO_CACHE_S3_REGION, assumes awsS3TenantRoleArn via STS (optionally using provisioner keys), and creates a 15‑min pre‑signed URL to <owner>/<repo>/cache.tar.zst using @aws-sdk/s3-request-presigner (AWS default endpoint).
  • Sandbox provider passes owner, name, and denoCachePresignedUrl into TenantConfig; the daemon’s tryWarmDenoCache downloads and restores into $DENO_DIR (non‑fatal on errors).
  • Sandbox image includes zstd for .tar.zst extraction.

• Migration

  • Configure mesh with DECO_CACHE_S3_BUCKET, DECO_CACHE_S3_REGION, and awsS3TenantRoleArn; remove any sandbox Helm decoCache/DECO_CACHE_S3_* and serviceAccountName values. Remove DECO_CACHE_S3_ENDPOINT if present.
  • Ensure the repo owner and name are provided so mesh can build the cache object path.

^{Written for commit a930e64. Summary will update on new commits.}