refactor(conf): rename BlobBackends proto message to ManagedCASBackends

The proto message and its YAML field describe configuration for
*managed* CAS backends (provisioned and operated by Chainloop), not
generic blob storage. Rename:

* proto message `BlobBackends` -> `ManagedCASBackends`
* proto field `blob_backends` -> `managed_cas_backends` in both
  controlplane and artifact-cas Bootstrap messages
* matching Go field on the regenerated `*conf.Bootstrap`
  (`ManagedCasBackends`) and references in wire.go / wire_gen.go
* commented-out example block in both `config.devel.yaml`

No behavioural change; the only deployments that read this block today
are local-dev configs (gitignored config.local.yaml) which have been
updated separately.

Assisted-by: Claude Code
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>

Chainloop-Trace-Sessions: 234a03ed-b238-4506-95f0-235242842db2

Author: jiparis

app/artifact-cas/cmd/wire.go

@@ -39,7 +39,7 @@ func wireApp(*conf.Bootstrap, *conf.Server, *conf.Auth, credentials.Reader, log.
 			service.ProviderSet,
 			loader.LoadProviders,
 			newLoaderOptions,
-			wire.FieldsOf(new(*conf.Bootstrap), "BlobBackends"),
+			wire.FieldsOf(new(*conf.Bootstrap), "ManagedCasBackends"),
 			newApp,
 			serviceOpts,
 			newProtoValidator,
@@ -48,11 +48,11 @@ func wireApp(*conf.Bootstrap, *conf.Server, *conf.Auth, credentials.Reader, log.
 }
 
 // newLoaderOptions builds the loader.Options struct from the deployment
-// Bootstrap. When `blob_backends.s3_access_point` is absent (the common
-// case for on-prem) S3AccessPoint stays nil and the provider is not
-// registered, leaving the binary's behaviour identical to the pre-managed
-// CAS world.
-func newLoaderOptions(in *conf.BlobBackends, l log.Logger) *loader.Options {
+// Bootstrap. When `managed_cas_backends.s3_access_point` is absent (the
+// common case for on-prem) S3AccessPoint stays nil and the provider is
+// not registered, leaving the binary's behaviour identical to the
+// pre-managed-CAS world.
+func newLoaderOptions(in *conf.ManagedCASBackends, l log.Logger) *loader.Options {
 	opts := &loader.Options{Logger: l}
 	if in == nil || in.GetS3AccessPoint() == nil {
 		return opts

app/artifact-cas/cmd/wire_gen.go

@@ -41,10 +41,10 @@ auth:
   public_key_path: ${PUBLIC_KEY_PATH:../../devel/devkeys/cas.pub}
 
 # Optional managed CAS provider (S3 Access Points). Mirrors the
-# controlplane's blob_backends block — both binaries must agree on the
-# settings since each independently instantiates the provider. Leave
-# commented out for on-prem deployments that don't use managed CAS.
-# blob_backends:
+# controlplane's managed_cas_backends block — both binaries must agree
+# on the settings since each independently instantiates the provider.
+# Leave commented out for on-prem deployments that don't use managed CAS.
+# managed_cas_backends:
 #   s3_access_point:
 #     base_role_arn: arn:aws:iam::123456789012:role/chainloop-cas-tenant
 #     region: us-east-1

app/artifact-cas/configs/config.devel.yaml

@@ -25,10 +25,10 @@ message Bootstrap {
   Auth auth = 2;
   Observability observability = 3;
   credentials.v1.Credentials credentials_service = 4;
-  // Deployment-level configuration for storage backend providers that
-  // need ambient knobs beyond what's stored per-CASBackend. Optional —
+  // Deployment-level configuration for managed CAS storage backends
+  // (provisioned and operated by Chainloop, not by tenants). Optional —
   // omitting a sub-block keeps the corresponding provider unregistered.
-  BlobBackends blob_backends = 5;
+  ManagedCASBackends managed_cas_backends = 5;
 
   message Observability {
     Sentry sentry = 1;
@@ -83,11 +83,11 @@ message Server {
   HTTP http_metrics = 3;
 }
 
-// BlobBackends mirrors the controlplane's `BlobBackends` block. Defined
-// independently here so the artifact-cas binary doesn't depend on the
-// controlplane's protobuf package. Keep field numbering in sync across
-// both definitions.
-message BlobBackends {
+// ManagedCASBackends mirrors the controlplane's `ManagedCASBackends`
+// block. Defined independently here so the artifact-cas binary doesn't
+// depend on the controlplane's protobuf package. Keep field numbering
+// in sync across both definitions.
+message ManagedCASBackends {
   S3AccessPoint s3_access_point = 1;
 
   message S3AccessPoint {

app/artifact-cas/internal/conf/conf.pb.go

@@ -61,7 +61,7 @@ func wireApp(context.Context, *conf.Bootstrap, credentials.ReaderWriter, log.Log
 			wire.Bind(new(biz.CASClient), new(*biz.CASClientUseCase)),
 			serviceOpts,
 			wire.Value([]biz.CASClientOpts{}),
-			wire.FieldsOf(new(*conf.Bootstrap), "Server", "Auth", "Data", "CasServer", "ReferrerSharedIndex", "Onboarding", "PrometheusIntegration", "PolicyProviders", "NatsServer", "FederatedAuthentication", "OperationAuthorizationProvider", "BlobBackends"),
+			wire.FieldsOf(new(*conf.Bootstrap), "Server", "Auth", "Data", "CasServer", "ReferrerSharedIndex", "Onboarding", "PrometheusIntegration", "PolicyProviders", "NatsServer", "FederatedAuthentication", "OperationAuthorizationProvider", "ManagedCasBackends"),
 			wire.FieldsOf(new(*conf.Data), "Database"),
 			dispatcher.New,
 			authz.NewCasbinEnforcer,
@@ -129,11 +129,11 @@ func serviceOpts(l log.Logger, authzUC *biz.AuthzUseCase, pUC *biz.ProjectUseCas
 }
 
 // newLoaderOptions builds the loader.Options struct from the deployment
-// Bootstrap. When `blob_backends.s3_access_point` is absent (the common
-// case for on-prem) S3AccessPoint stays nil and the provider is not
-// registered, leaving the binary's behaviour identical to the pre-managed
-// CAS world.
-func newLoaderOptions(in *conf.BlobBackends, l log.Logger) *loader.Options {
+// Bootstrap. When `managed_cas_backends.s3_access_point` is absent (the
+// common case for on-prem) S3AccessPoint stays nil and the provider is
+// not registered, leaving the binary's behaviour identical to the
+// pre-managed-CAS world.
+func newLoaderOptions(in *conf.ManagedCASBackends, l log.Logger) *loader.Options {
 	opts := &loader.Options{Logger: l}
 	if in == nil || in.GetS3AccessPoint() == nil {
 		return opts