Bound the installer's wait for The Combine to come up

[imnasnainaec]

Split out of #4352, part 4 of 4 — see
#4352 (comment) for the split and how it was verified.

Stacked on #4355. The base is fix/database-first-boot, not master: wait-for-semantic-domains polls
CombineDatabase.SemanticDomainImportStatus, and nothing writes that record until #4355 lands. On its own against
master this would fail a first install after IMPORT_CHECK_TIMEOUT_SECONDS with the manual-import hint. Review the
deploy/scripts/install-combine.sh commits here; the four files from #4355 show up in the diff until that merges.

wait-for-combine only ever read one deployment's READY count. Collapsing the kubectl table with an unquoted
expansion put every row on one line, so grep matched the whole line for each name and the greedy sed captured the
last N/1 in it — the alphabetically last deployment, maintenance. So the installer could stop k3s while the rest
were still coming up, and stopping k3s SIGKILLs pods, since the unit is patched to KillMode=mixed.

• Replace the parsing with kubectl wait, checking the database first: everything else depends on it and it is the
  slowest to come up on a first install.
• Wait for the database to record a completed semantic domain import before the shutdown, so that an interrupted
  import does not silently cost the user another one.
• Pace and bound both waits. kubectl wait returns at once rather than blocking when the API is unreachable or the
  deployment is gone, so the retry loop could spin, pegging a core and flooding the terminal; and neither wait had an
  upper bound, so a deployment that was never going to come up produced no error, ever. Each stage now has a deadline,
  prints the pods in the namespace before exiting, and resumes if the installer is rerun.
• Validate WAIT_TIMEOUT_SECONDS, which went into arithmetic unchecked: bash reads a non-number as 0 and a leading
  zero as octal, so abc became a deadline already passed, 007 seven seconds, and 3600s a bare arithmetic error.
  The check sits with the other install-only setup, so a bad value in the environment cannot stop an uninstall.
• Let single-step stop after Wait-for-combine, so a running cluster can be inspected before the installer stops it.

Scope

One file: deploy/scripts/install-combine.sh, and all of its hunks except the Shutdown-combine one, which is in
#4353. Verified: the only difference between this branch's copy of the script and #4352's is that hunk.

The timeout row of installer/README.md went to #4355 and the update row to #4353, so nothing is left here for
that file. Verified conflict-free against #4353 and #4354.

QA and prod

None. install-combine.sh ships in combine-installer.run; QA and prod are deployed by
.github/actions/combine-deploy-update, which runs setup_combine.py directly. The installer's own server option
is the only server-shaped path it touches, and that path skips Shutdown-combine entirely.

Testing

Not yet exercised on hardware. The waits are the whole substance here, so this wants a real first install — including
the timeout paths, which are easiest to reach by setting WAIT_TIMEOUT_SECONDS low.

🤖 Generated with Claude Code

---

This change is 

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 03ce12f2-c5a7-43d8-8b65-5d75bfb56297

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.96%. Comparing base (7191cb2) to head (617aeff).

Additional details and impacted files

@@                   Coverage Diff                    @@
##           fix/database-first-boot    #4356   +/-   ##
========================================================
  Coverage                    75.96%   75.96%           
========================================================
  Files                          305      305           
  Lines                        11384    11384           
  Branches                      1411     1411           
========================================================
  Hits                          8648     8648           
  Misses                        2332     2332           
  Partials                       404      404           

Flag	Coverage Δ
backend	87.22% <ø> (ø)
frontend	66.88% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.