fix(agent): reuse a valid lease token across applies; a rate-limited lease no longer blocks a deploy; 0.1.6

Every apply requested a new lease, so a failing deploy retried by the 60 s
timer burned tenancy's 5-leases-per-hour budget and then failed on
LEASE_RATE_LIMITED forever (env-qa-02 pilot). Now: reuse a lease-derived
token while lookup-self says it is valid; swap the bootstrap token for a
lease once; if tenancy rate-limits the lease while a working token exists,
apply with it and defer the swap.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1

monky_deployd/__init__.py

@@ -4,4 +4,4 @@ Dials monky-tenancy over the mesh with the box's host identity, fetches the rend
 leases a deploy grant, logs in to OpenBao, reads its own secrets, runs `docker compose`,
 reports. Stdlib only; the optional `openziti` SDK is the `sdk` transport."""
 
-__version__ = "0.1.5"
+__version__ = "0.1.6"

monky_deployd/agent.py

@@ -277,7 +277,7 @@ class Agent:
         # secrets: lease -> login -> reads (values never logged; names only)
         entries = b.manifest.get("entries", [])
         if entries:
-            token = self._lease_login("apply")
+            token = self._token_for_apply()
             for e in entries:
                 self._values[e["var"]] = self.bao.kv_read(token, e["path"], cfg.env_id, e.get("version"))
             log.info("read %d secret(s): %s", len(entries), ", ".join(sorted(self._values)))
@@ -392,6 +392,29 @@ class Agent:
         if old and old != token:
             self.bao.revoke_self(old)
 
+    def _token_for_apply(self) -> str:
+        """The OpenBao token to read this bundle's secrets with. A lease-derived token that is
+        still valid is REUSED (a lease per apply burned tenancy's 5/h budget on every retry —
+        env-qa-02 pilot, 2026-09-07); the bootstrap token is swapped for a lease once; and if
+        tenancy rate-limits the lease while we hold a working token, apply with what we have
+        and swap later rather than fail the deploy."""
+        cfg = self.cfg
+        st = self.state.token
+        if self.token and st is not None and st.source == "lease":
+            try:
+                info = self.bao.lookup_self(self.token)
+                if int(info.get("ttl") or 0) > cfg.bao.renew_below_s:
+                    return self.token
+            except BaoError as exc:
+                log.info("lease token no longer valid (%s); re-leasing", exc)
+        try:
+            return self._lease_login("apply")
+        except RateLimited as exc:
+            if self.token:
+                log.warning("lease rate-limited (%s); applying with the current token, swap deferred", exc)
+                return self.token
+            raise
+
     def _lease_login(self, reason: str) -> str:
         assert self.tenancy is not None
         lease = self.tenancy.lease(reason)