[AZ-962] [AZ-964] [AZ-965] operator_replay.yaml + Tier-2 wiring

AZ-962 SHIPPED — Tier-2 Jetson AZ-840 orchestrator test no longer
SKIPs at the env-var gate. configs/operator_replay.yaml registers
c6/c7/c10/c11 with sane defaults (backbones intentionally empty,
see AZ-965); docker-compose.test.jetson.yml exports
GPS_DENIED_OPERATOR_CONFIG_PATH=/opt/configs/operator_replay.yaml
and bind-mounts ./configs:/opt/configs:ro. ENV_KEY_MAP gains
SATELLITE_PROVIDER_URL → c11_tile_manager.satellite_provider_url
and SATELLITE_PROVIDER_API_KEY → c11_tile_manager.service_api_key
so secrets flow from .env.test and never sit in YAML. README drops
the manual export step. 97/97 c11 + config unit tests stay green.

Tier-2 re-run (4 failed / 48 passed / 1 skipped / 1 xfailed /
1 xpassed / 2 errors in 84.99s vs baseline 3 skipped — i.e. -2
skipped, +2 errors): AZ-840 orchestrator test moves from SKIP to
ERROR with a deeper, real gate — IndexUnavailableError on
FaissDescriptorIndex against a fresh c6_tile_cache.root_dir.

AZ-964 (3 SP, todo/) filed for FAISS index bootstrap in the AZ-839
C3 fixture. AZ-965 (3 SP, todo/, blocked by AZ-964) filed for
NetVLAD ONNX backbone provisioning — the next gate the orchestrator
test will hit once FAISS clears.

Cycle-4 e2e gate remains NOT GREEN: AZ-840 chain is now AZ-964 →
AZ-965 → PASS; 60s smoke chain is AZ-963 → PASS. OKVIS2 deferral
directive (2026-05-29) unchanged — still gated behind Derkachi
e2e green, still NOT MET.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/gps_denied_onboard/config/loader.py

@@ -74,6 +74,14 @@ ENV_KEY_MAP: Final[dict[str, tuple[str, str]]] = {
     "REPLAY_PACE": ("replay", "pace"),
     "REPLAY_TIME_OFFSET_MS": ("replay", "time_offset_ms"),
     "REPLAY_TARGET_FC_DIALECT": ("replay", "target_fc_dialect"),
+    # C11 tile-manager URL + bearer (AZ-962) — the Jetson harness +
+    # operator-orchestrator deploys inject these via env so the YAML
+    # never carries a real secret. `build_tile_downloader` raises if
+    # `service_api_key` is empty; mapping it through ENV_KEY_MAP lets
+    # the e2e harness fill the field from `.env.test` without a YAML
+    # override step.
+    "SATELLITE_PROVIDER_URL": ("c11_tile_manager", "satellite_provider_url"),
+    "SATELLITE_PROVIDER_API_KEY": ("c11_tile_manager", "service_api_key"),
 }
 
 # Env vars that MUST resolve to a non-empty value before `load_config`
@@ -122,6 +130,9 @@ _FIELD_COERCIONS: Final[dict[str, type]] = {
     "output_path": str,
     "pace": str,
     "target_fc_dialect": str,
+    # C11 (AZ-962)
+    "satellite_provider_url": str,
+    "service_api_key": str,
 }