feat: release v1.46.0 theta-suite with Zero-View secrets engine, theta-agent get-secret CLI, and LDAP tunnel

bootstrap/bootstrap.js

@@ -642,24 +642,12 @@ async function seedDirectory(token, clientId, jumpClientId) {
 		requestable: false,
 	});
 
-	// OpenBao and its renewer sidecar are part of what the stack deploys, so
-	// they belong in the directory like every other component. Without entries
-	// their containers had nowhere to attach and showed up as parentless
-	// discoveries on a fresh install.
-	await ensure('service', 'OpenBao', 'openbao', host.id, {
-		address: 'http://openbao:8200',
-		port: 8200,
-		subType: 'vault',
-		icon: 'mdi:safe',
-		tagline: 'Secrets store for the stack.',
-		requestable: false,
-	});
-	await ensure('service', 'Bao Renewer', 'bao-renewer', host.id, {
-		subType: 'sidecar',
-		icon: 'mdi:autorenew',
-		tagline: 'Renews the stack service tokens against OpenBao.',
-		requestable: false,
-	});
+	// Remove legacy OpenBao/bao-renewer seed resources if present — OpenBao is an
+	// internal stack service, not a user-facing published directory service.
+	const openbaoRes = resources.find((r) => r.slug === 'openbao');
+	const renewerRes = resources.find((r) => r.slug === 'bao-renewer');
+	if (openbaoRes) await dirDelete(token, `resources/${openbaoRes.id}`);
+	if (renewerRes) await dirDelete(token, `resources/${renewerRes.id}`);
 
 	// SSH jump host service (core component — always registered).
 	let jumpSvc = null;