Maintain a small patch overlay for libntech/cfengine defects load-bearing on the generic bundle

[djbclark]

Why

policy/tendcf_services.cf (v1, launchd-only generic bundle, shipped
222da45) now actually depends at runtime on CFEngine/libntech code paths
we've found real defects in this week, filed upstream but not yet reviewed:

• The bundle's plist rendering uses template_method => "mustache"
  (libntech mustache.c).
• Any host_specific.json string value containing a backslash (env
  values, argv elements, CMDB data generally) round-trips through
  libntech's JSON parser, which currently double-decodes escapes.
• host_specific.json itself is loaded through cfengine/core's CMDB
  loader, where one malformed entry used to drop its entire section.

17 PRs are open across cfengine/core and NorthernTechHQ/libntech with
essentially no reviewer engagement yet on the newest ones. Waiting on
upstream review shouldn't block testing/using our own bundle against a
correct build in the meantime.

Decision

Don't maintain full parallel forks of libntech/cfengine (ongoing
rebase/build/distribute burden this design has otherwise avoided — see
the guide's narrow "fork only to patch" stance for nix2cf/Shizuku). Keep
a small overlay pinned to a specific upstream commit, containing only
patches that are load-bearing for code we've actually shipped. Drop each
patch the moment its PR merges upstream.

Scope (exact commits, from docs/architecture/upstream-register.md)

libntech, base 0c0620d — two independent branches, no file overlap,
mergeable directly:

• fix/json-double-decode
  (B-14, stacked on B-13/90cf8cc) —
  libntech#297,
  CFE-4731
• fix/mustache-minor-defects
  (B-23, stacked on B-22) —
  libntech#298,
  CFE-4740

cfengine/core, base a0bca6aaf:

• fix/cmdb-one-bad-entry-skips-only-that-entry
  tip 8f0076b81 (already has B-5a/958d13949 stacked under it) —
  cfengine/core#6320,
  CFE-4720

Mechanics (not yet done)

1. One merge commit combining libntech's two branch tips onto 0c0620d.
2. Point cfengine/core's libntech submodule at that merged commit.
3. Build core at 8f0076b81 with the updated submodule pointer.
4. Document the recipe (base commits + branches) somewhere reproducible —
   this issue, or a docs/architecture/ note if it grows — so a future
   session doesn't have to re-derive it from upstream-register.md.

No CI wiring yet: tendcf doesn't build/ship anything today (see README —
"Nothing described here is deployed"). This overlay is for local testing
of .cf policy against a correct build, the same way this session
verified policy/tendcf_services.cf ad hoc against the core-cmdbkey
worktree. Real packaging/pinning belongs to whenever tendcf-agent's build
pipeline actually exists — don't build that infra early.

Close when

Each component patch drops off this list as its upstream PR merges. Issue
closes when the list is empty (upstream has caught up) or when a real
build pipeline supersedes this with proper pinning.

[djbclark]

Mechanics done, verified locally:

1. New worktree libntech-overlay (branch overlay/tendcf-3, based off the
   cfengine-core submodule's shared object store) merged the two branch
   tips onto 0c0620d with a plain octopus merge — no conflicts, confirming
   the "no file overlap" read in the issue body:
   git merge fix/json-double-decode fix/mustache-minor-defects
   → merge commit 45c816cecafa38e9097995a3ccd2940ddccbd44a.

2. Pointed core-cmdbkey's libntech submodule at that merge commit
   (fetched it in locally since that worktree has its own separate
   submodule object store, not shared with the main checkout's). Left this
   as an uncommitted, dirty submodule pointer in the working tree — local
   testing only, per the issue's "no packaging yet" scope, not something to
   push.

3. Full make -j4 at core-cmdbkey's root (tip 8f0076b81) built clean
   against the updated submodule.

4. Verified all three defects are actually fixed in this combined build,
   not just that it compiles:

   • libntech/tests/unit/json_test: 74/74 pass
   • libntech/tests/unit/mustache_test: 17/17 pass
   • tests/acceptance/00_basics/06_host_specific_data/ (fakeroot,
     fresh BASE_WORKDIR): 14/14 pass, including
     16-variable-references-good-entry-survives.cf, the acceptance test
     added with the CMDB fix itself.

Recipe is reproducible from the issue body's exact commits/branches; no
further doc needed since it didn't grow beyond this. Leaving the worktrees
(libntech-overlay, core-cmdbkey) in place for reuse next time this needs
rebuilding, until a component drops off the list.