Give stalwart-apply a writable HOME (#549)

The stalwart-apply PostSync Job fails with "Read-only file system": stalwart-cli caches the server schema under $HOME/.cache, which sits on the read-only root. The plan never applies, so Stalwart runs without its certificate, listeners or stdout tracer.

- mount a /tmp emptyDir in both Job containers
- set HOME=/tmp for the cli and kubectl (discovery cache)

Reviewed-on: #549
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

apps/base/mail/stalwart-apply-job.yaml

@@ -34,6 +34,9 @@ spec:
             - --file
             - /plan/plan.ndjson
           env:
+            # the cli caches the server schema under $HOME/.cache
+            - name: HOME
+              value: /tmp
             - name: STALWART_URL
               value: http://stalwart.mail.svc:8080
             - name: STALWART_USER
@@ -63,6 +66,8 @@ spec:
             - name: plan
               mountPath: /plan
               readOnly: true
+            - name: tmp
+              mountPath: /tmp
       containers:
         - name: restart
           image: registry.k8s.io/kubectl:v1.33.13
@@ -71,6 +76,9 @@ spec:
             - restart
             - statefulset/stalwart
             - --namespace=mail
+          env:
+            - name: HOME
+              value: /tmp
           securityContext:
             runAsUser: 65532
             runAsGroup: 65532
@@ -86,6 +94,9 @@ spec:
             requests:
               cpu: 50m
               memory: 32Mi
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
       volumes:
         - name: plan
           configMap:
@@ -93,3 +104,5 @@ spec:
             items:
               - key: plan.ndjson
                 path: plan.ndjson
+        - name: tmp
+          emptyDir: {}