fix: keep hwlab runtime gitops guard on manual refresh

scripts/native/cicd/hwlab-node-control-plane-refresh.mjs

@@ -144,6 +144,7 @@ async function applyPipeline() {
   if (typeof renderedPipelineName !== "string" || renderedPipelineName.length === 0) {
     throw new Error(`rendered Pipeline metadata.name missing: ${pipelinePath}`);
   }
+  const runtimeGitopsScripts = await applyRuntimeGitopsScriptsConfigMap();
   const runtimeGitopsGuard = injectRuntimeGitopsGuard(pipeline);
   const render = summarizeRenderedPipeline(pipeline, renderedPipelineName, runtimeGitopsGuard);
   const pipelineName = requiredOverlayString("pipelineName");
@@ -158,10 +159,46 @@ async function applyPipeline() {
   );
   return {
     render,
+    runtimeGitopsScripts,
     apply: summarizeAppliedPipeline(parseJsonObject(applyText), pipelineName, tektonNamespace),
   };
 }
 
+async function applyRuntimeGitopsScriptsConfigMap() {
+  const data = {};
+  for (const name of ["runtime-gitops-observability.mjs", "runtime-gitops-postprocess.mjs", "runtime-gitops-verify.mjs"]) {
+    data[name] = readFileSync(`/etc/unidesk-cicd-branch-follower/${name}`, "utf8");
+  }
+  const YAML = yamlModule();
+  const applied = parseJsonObject(await kubeRequest(
+    "PATCH",
+    `/api/v1/namespaces/${encodeURIComponent(tektonNamespace)}/configmaps/${encodeURIComponent(runtimeGitopsConfigMapName)}?fieldManager=${encodeURIComponent(fieldManager)}&force=true`,
+    YAML.stringify({
+      apiVersion: "v1",
+      kind: "ConfigMap",
+      metadata: {
+        name: runtimeGitopsConfigMapName,
+        namespace: tektonNamespace,
+        labels: {
+          "app.kubernetes.io/name": "hwlab-runtime-gitops-scripts",
+          "app.kubernetes.io/part-of": "unidesk-cicd-branch-follower",
+          "hwlab.pikastech.local/node": overlay.nodeId,
+          "hwlab.pikastech.local/lane": overlay.lane,
+        },
+      },
+      data,
+    }),
+    "application/apply-patch+yaml",
+  ));
+  const metadata = recordOrNull(applied?.metadata);
+  return {
+    name: stringOrNull(metadata?.name) || runtimeGitopsConfigMapName,
+    namespace: stringOrNull(metadata?.namespace) || tektonNamespace,
+    resourceVersion: stringOrNull(metadata?.resourceVersion),
+    keyCount: Object.keys(data).length,
+  };
+}
+
 function yamlModule() {
   const requireFromDeps = createRequire(path.join(depsDir, "package.json"));
   return requireFromDeps("yaml");