feat!: rename carbide/forge → NVIDIA Infrastructure Controller (NICo)

- Rename all carbide/forge references to NICo across Go source, Helm charts,
  Dockerfiles, protobuf schemas, and generated code
- Add role constants (ProviderAdminRole, TenantAdminRole, ProviderViewerRole)
  as single source of truth; replace all string literals with constants
- Strip legacy role prefix (NICO_/FORGE_) before role lookup to handle
  transition-period data stored with old prefixes
- Maintain backward compat with forge.nvidia.io CRD group: dual-client
  architecture with fallback so existing site agents stay connected
- Add CARBIDE_* env var fallbacks in site-agent config manager for
  deployment config repo transition to NICO_* var names
- Add legacy forge.nvidia.io CRD and RBAC rules with TODO cleanup markers

Author: shayan1995

.coderabbit.yaml

@@ -13,7 +13,7 @@ reviews:
   collapse_walkthrough: false
   path_filters:
     - "!**/*.pb.go"
-    - "!workflow-schema/site-agent/workflows/v1/*_carbide.proto"
+    - "!workflow-schema/site-agent/workflows/v1/*_nico.proto"
   path_instructions:
     - path: '**/*.go'
       instructions: >-

.github/scripts/promote-single-ngc-resource.sh

@@ -29,6 +29,7 @@ RESOURCE_NAME="$3"
 SOURCE_TAG="$4"
 SEMANTIC_VERSION="$5"
 
+# TODO: rename to "nico" once the NGC team is created under the org
 DEST_TEAM="carbide"
 
 mkdir -p ~/.ngc
@@ -73,7 +74,7 @@ ngc registry resource download-version "${SOURCE_ORG}/${SOURCE_TEAM}/${RESOURCE_
 
 FILE_PATH=$(find download_temp -type f | head -n 1)
 if [ -f "$FILE_PATH" ]; then
-    echo "Uploading to carbide/$RESOURCE_NAME:$SEMANTIC_VERSION..."
+    echo "Uploading to nico/$RESOURCE_NAME:$SEMANTIC_VERSION..."
     export NGC_CLI_API_KEY=${DEST_TOKEN} NGC_CLI_ORG=$SOURCE_ORG NGC_CLI_TEAM=$DEST_TEAM
     push_ngc_resouce "$SOURCE_ORG" "$DEST_TEAM" "$RESOURCE_NAME" "$SEMANTIC_VERSION" "$FILE_PATH"
 else

.github/workflows/README.md

@@ -36,15 +36,15 @@ Reusable workflow that generates version information and build metadata.
 Reusable workflow that builds and pushes all Docker images.
 
 **Images Built:**
-1. `carbide-rest-api`
-2. `carbide-rest-db`
-3. `carbide-rest-site-manager`
-4. `carbide-rest-workflow`
-5. `carbide-rest-site-agent`
-6. `carbide-rest-cert-manager`
-7. `carbide-rla`
-8. `carbide-psm`
-9. `carbide-nsm`
+1. `nico-rest-api`
+2. `nico-rest-db`
+3. `nico-rest-site-manager`
+4. `nico-rest-workflow`
+5. `nico-rest-site-agent`
+6. `nico-rest-cert-manager`
+7. `nico-rla`
+8. `nico-psm`
+9. `nico-nsm`
 
 **Note:** This workflow uses production-optimized multi-stage Dockerfiles located in `docker/production/`.
 ## Required Secrets
@@ -85,12 +85,12 @@ Edit `.github/workflows/prepare-build-info.yml` and update the `target_registry`
 
 ```yaml
 # Line ~57
-target_registry="nvcr.io/dsx/your-team/carbide"
+target_registry="nvcr.io/dsx/your-team/nico"
 ```
 
 Replace `your-team` with appropriate NGC team name. Available options are:
-- *carbide-dev*: For all development images
-- *carbide*: Production promoted images
+- *nico-dev*: For all development images
+- *nico*: Production promoted images
 
 ### Customize Runner
 
@@ -129,7 +129,7 @@ This allows you to:
 
 Pushes to `main` branch will receive the following tags:
 
-1. **VERSION + Git Short SHA**: `<image>:1.0.0=<short-sha>` (e.g., `carbide-rest-api:1.0.0-abc1234`)
+1. **VERSION + Git Short SHA**: `<image>:1.0.0=<short-sha>` (e.g., `nico-rest-api:1.0.0-abc1234`)
    - Primary tag for reproducibility and traceability
    - Unique for each commit in `main` branch
 
@@ -138,12 +138,12 @@ Pushes to `main` branch will receive the following tags:
 
 Version git tags will receive the following docker tag:
 
-1. **Version Tag**: `<image>:<tag>` (e.g., `carbide-rest-api:v1.2.3`)
+1. **Version Tag**: `<image>:<tag>` (e.g., `nico-rest-api:v1.2.3`)
    - Based on tags pushed with v* format
 
 Commits to branches containing `push-container` will receive Git short SHA tag:
 
-1. **Branch Name + Git Short SHA Tag**: `<image>:fix-api-<short-sha>` (e.g., `carbide-rest-api:fix-api-ghi678`)
+1. **Branch Name + Git Short SHA Tag**: `<image>:fix-api-<short-sha>` (e.g., `nico-rest-api:fix-api-ghi678`)
    - Allows developers to push their in-progress work to dev environments
 
 ## Usage Examples
@@ -178,13 +178,13 @@ docker login nvcr.io
 # Password: <your-ngc-api-key>
 
 # Pull by SHA (recommended for production)
-docker pull nvcr.io/dsx/your-team/carbide/carbide-rest-api:1.2.3-abc1234
+docker pull nvcr.io/dsx/your-team/nico/nico-rest-api:1.2.3-abc1234
 
 # Pull by version
-docker pull nvcr.io/dsx/your-team/carbide/carbide-rest-api:v1.2.3
+docker pull nvcr.io/dsx/your-team/nico/nico-rest-api:v1.2.3
 
 # Pull latest
-docker pull nvcr.io/dsx/your-team/carbide/carbide-rest-api:latest
+docker pull nvcr.io/dsx/your-team/nico/nico-rest-api:latest
 ```
 
 ## Build Cache
@@ -237,9 +237,9 @@ To build only specific images based on file changes, you can add path filters:
   with:
     filters: |
       api:
-        - 'docker/production/Dockerfile.carbide-rest-api'
+        - 'docker/production/Dockerfile.nico-rest-api'
       db:
-        - 'docker/production/Dockerfile.carbide-rest-db'
+        - 'docker/production/Dockerfile.nico-rest-db'
 
 - name: Build API
   if: steps.filter.outputs.api == 'true'