Move global.push config to salt.auto_apply

The active-push tunables (enabled, highstate_interval_hours, debounce_seconds,
drain_interval, batch, batch_wait) described how Salt auto-applies changes, not
general grid config, so relocate them from the global namespace to a new
salt.auto_apply settings module.

- Add salt/salt/{defaults.yaml,auto_apply.map.jinja,soc_salt.yaml,adv_salt.yaml}.
  auto_apply.map.jinja is a dedicated, side-effect-free merge map (the existing
  salt/salt/map.jinja dereferences pillar.host.mainint at import time).
- Remove the push blocks from salt/global/{defaults,soc_global}.yaml.
- Register salt.soc_salt/salt.adv_salt in pillar/top.sls; seed the local pillar
  stubs for fresh installs (make_some_dirs) and upgrades (ensure_salt_local_pillar
  in soup, wired into up_to_3.2.0).
- Repoint all consumers: GLOBALMERGED.push.* -> AUTOAPPLY.* (schedule, salt
  master, manager beacons, beacons_pushstate, orch.push_batch) and
  pillar.get('global:push...') -> 'salt:auto_apply...' (push reactors,
  so-push-drainer).
- Add a salt: fleetwide-highstate entry to pillar_push_map.yaml so edits keep
  applying immediately, matching the prior global-namespace behavior.

salt/manager/tools/sbin/so-push-drainer

@@ -60,9 +60,9 @@ def _make_logger():
 
 
 def _load_push_cfg():
-    """Read the global:push pillar subtree via salt-call. Returns a dict."""
+    """Read the salt:auto_apply pillar subtree via salt-call. Returns a dict."""
     caller = salt.client.Caller()
-    cfg = caller.cmd('pillar.get', 'global:push', {})
+    cfg = caller.cmd('pillar.get', 'salt:auto_apply', {})
     return cfg if isinstance(cfg, dict) else {}
 
 
@@ -135,7 +135,7 @@ def main():
     try:
         push = _load_push_cfg()
     except Exception:
-        log.exception('failed to read global:push pillar; aborting drain pass')
+        log.exception('failed to read salt:auto_apply pillar; aborting drain pass')
         return 1
 
     if not push.get('enabled', True):

salt/manager/tools/sbin/soup

@@ -690,6 +690,21 @@ ensure_postgres_local_pillar() {
   chown -R socore:socore "$dir"
 }
 
+ensure_salt_local_pillar() {
+  # The salt.auto_apply settings (moved from global.push) are a new SOC settings
+  # module, so the new pillar/top.sls references salt.soc_salt / salt.adv_salt
+  # unconditionally. Managers upgrading from before this change have no
+  # /opt/so/saltstack/local/pillar/salt/ (make_some_dirs only runs at install
+  # time), so the stubs must be created here before salt-master restarts against
+  # the new top.sls.
+  echo "Ensuring salt local pillar stubs exist."
+  local dir=/opt/so/saltstack/local/pillar/salt
+  mkdir -p "$dir"
+  [[ -f "$dir/soc_salt.sls" ]] || touch "$dir/soc_salt.sls"
+  [[ -f "$dir/adv_salt.sls" ]] || touch "$dir/adv_salt.sls"
+  chown -R socore:socore "$dir"
+}
+
 ensure_postgres_secret() {
   # On a fresh install, generate_passwords + secrets_pillar seed
   # secrets:postgres_pass in /opt/so/saltstack/local/pillar/secrets.sls. That
@@ -851,6 +866,8 @@ kibana_backport_streams_index_template() {
 }
 
 up_to_3.2.0() {
+  ensure_salt_local_pillar
+
   fix_logstash_0013_lumberjack_pipeline_name
 
   pin_elasticsearch_data_retention_method