Move global.push config to salt.auto_apply

The active-push tunables (enabled, highstate_interval_hours, debounce_seconds,
drain_interval, batch, batch_wait) described how Salt auto-applies changes, not
general grid config, so relocate them from the global namespace to a new
salt.auto_apply settings module.

- Add salt/salt/{defaults.yaml,auto_apply.map.jinja,soc_salt.yaml,adv_salt.yaml}.
  auto_apply.map.jinja is a dedicated, side-effect-free merge map (the existing
  salt/salt/map.jinja dereferences pillar.host.mainint at import time).
- Remove the push blocks from salt/global/{defaults,soc_global}.yaml.
- Register salt.soc_salt/salt.adv_salt in pillar/top.sls; seed the local pillar
  stubs for fresh installs (make_some_dirs) and upgrades (ensure_salt_local_pillar
  in soup, wired into up_to_3.2.0).
- Repoint all consumers: GLOBALMERGED.push.* -> AUTOAPPLY.* (schedule, salt
  master, manager beacons, beacons_pushstate, orch.push_batch) and
  pillar.get('global:push...') -> 'salt:auto_apply...' (push reactors,
  so-push-drainer).
- Add a salt: fleetwide-highstate entry to pillar_push_map.yaml so edits keep
  applying immediately, matching the prior global-namespace behavior.

salt/reactor/pillar_push_map.yaml

@@ -185,6 +185,17 @@ registry:
   - state: registry
     tgt: 'G@role:so-eval or G@role:so-import or G@role:so-manager or G@role:so-managerhype or G@role:so-managersearch or G@role:so-standalone'
 
+# salt: fanout to a fleetwide highstate. The salt.auto_apply settings tune the
+# push pipeline itself (enabled, debounce/drain intervals, batch sizing) and the
+# per-minion highstate schedule; they are consumed by the manager's schedule,
+# beacons, and master reactor config as well as every minion's highstate
+# schedule, so a targeted re-apply isn't meaningful. A salt audit row only fires
+# for SOC-driven salt.auto_apply edits -- salt version bumps go through soup, not
+# SOC, so they never reach this map.
+salt:
+  - highstate: True
+    tgt: '*'
+
 # sensoroni: universal.
 sensoroni:
   - state: sensoroni

salt/reactor/push_pillar.sls

@@ -59,9 +59,9 @@ def _load_push_map():
 def _push_enabled():
     try:
         caller = Caller()
-        return bool(caller.cmd('pillar.get', 'global:push:enabled', True))
+        return bool(caller.cmd('pillar.get', 'salt:auto_apply:enabled', True))
     except Exception:
-        LOG.exception('push_pillar: pillar.get global:push:enabled failed, assuming enabled')
+        LOG.exception('push_pillar: pillar.get salt:auto_apply:enabled failed, assuming enabled')
         return True
 
 

salt/reactor/push_strelka.sls

@@ -35,9 +35,9 @@ def _sensor_compound():
 def _push_enabled():
     try:
         caller = Caller()
-        return bool(caller.cmd('pillar.get', 'global:push:enabled', True))
+        return bool(caller.cmd('pillar.get', 'salt:auto_apply:enabled', True))
     except Exception:
-        LOG.exception('push_strelka: pillar.get global:push:enabled failed, assuming enabled')
+        LOG.exception('push_strelka: pillar.get salt:auto_apply:enabled failed, assuming enabled')
         return True
 
 

salt/reactor/push_suricata.sls

@@ -34,9 +34,9 @@ def _sensor_compound_plus_import():
 def _push_enabled():
     try:
         caller = Caller()
-        return bool(caller.cmd('pillar.get', 'global:push:enabled', True))
+        return bool(caller.cmd('pillar.get', 'salt:auto_apply:enabled', True))
     except Exception:
-        LOG.exception('push_suricata: pillar.get global:push:enabled failed, assuming enabled')
+        LOG.exception('push_suricata: pillar.get salt:auto_apply:enabled failed, assuming enabled')
         return True