fix: write baked manifest into the workspace

[Suneha Bose (bosesuneha)]

Fixes #286

Problem

k8s-deploy v7 rejects manifests that resolve outside GITHUB_WORKSPACE. Bake writes to RUNNER_TEMP, which is a sibling of the workspace on hosted runners, so the bake -> deploy chain fails and there is no way to override the location.

/home/runner/work/
├── _temp/        <- bake output
└── my-repo/
    └── my-repo/  <- GITHUB_WORKSPACE

Change

Output goes to $GITHUB_WORKSPACE/.k8s-bake/, falling back to RUNNER_TEMP with a warning when there is no workspace. A post-job step removes the manifest it generated, and the directory if that leaves it empty.

Applies to all three render engines through the shared getTemplatePath hook.

Breaking: the output location changes. Workflows reading ${{ steps.bake.outputs.manifestsBundle }} need no changes. k8s-deploy needs no changes.

Notes

Cleanup deletes only the filename the main step recorded, never a path from step state, and refuses symlinks. A pre-existing .k8s-bake directory or unrelated files in it are left alone.

Test plan

• npm test, 119 tests
• npm run build, tsc --noEmit, prettier --check
• End to end with the built bundle: output lands in the workspace, RUNNER_TEMP stays empty, post step leaves the checkout clean
• Baked output accepted by unmodified k8s-deploy v7
• Two bake steps in one job: each removes its own manifest, last one removes the directory
• Pre-existing .k8s-bake/user-file.txt and .k8s-bake/baked-template-123.yaml survive cleanup

Version bump and changelog follow in a separate release PR.

[David Gamero (davidgamero)]

lgtm