0.8.0-dev3.1: netbox_writeback_dry_run config knob (deploy-safety follow-up)

[stevenca]

Summary

Adds the missing toggle to put the worker's NetBox writeback loop into observe-only mode for a release rollout. The diff/report machinery in reconcile_to_netbox has supported dry_run=True end-to-end since 0.7.0; this PR just exposes it through Settings so an operator can flip it via env var (Helm worker.extraEnv) or via the core secret. Default remains False — production behavior unchanged for any deployment that doesn't explicitly opt in.

Motivation

cpn-ful-netcortex1 is currently running 0.6.0.dev66 (helm rev 53 from May 31). The merge of #1–#3 has pushed main to 0.8.0-dev3. Deploying to main actually rolls out everything since the public-repo initial publish: the full 0.7.0 NetBox-as-system-of-record release (commit 1c90b61), ThousandEyes adapter, FMC adapter, MCP auth, plus 0.8.0-dev1's NATS infrastructure and dev2/dev3 reflex foundations.

The risky portion of that delta is the 0.7.0 NetBox writeback work. A one-cycle observe-only baseline lets us verify the intended diff against the live NetBox before any PATCH/POST/DELETE fires.

Operational pattern

```bash
helm upgrade netcortex deploy/helm
--set image.tag=0.8.0-dev3.1
--set worker.extraEnv[0].name=NETBOX_WRITEBACK_DRY_RUN
--set worker.extraEnv[0].value="true"
--wait

kubectl -n netcortex logs deploy/netcortex-worker -f | grep netbox_writeback_done
helm upgrade netcortex deploy/helm --set image.tag=0.8.0-dev3.1 --wait
```

Test plan

• New `tests/test_config_writeback_dry_run.py` covers: default off, env truthy values, env falsy values, core-secret promotion, string-form core-secret values
• Existing CI: unit, contracts, lint, typecheck, golden, replay, security, SBOM jobs

Risk

Minimal. Settings-only addition with safe default (`False`). No template changes, no schema changes, no behavior change unless explicitly opted in.

Made with Cursor