Problem

Python sidecar adapters work zero-setup at runtime: the SDK (all adapter sources) is include_dir!-bundled into the daemon binary, and the live spawn path injects it onto the child's PYTHONPATH when the interpreter can't already import librefang.sidecar (librefang-channels::sidecar.rs → embedded_sdk::pythonpath_with_embedded). A fresh user needs only python3 on PATH — no pip install.

But the dashboard configure form never got the same treatment. The Add-a-channel form is schema-driven off python3 -m librefang.sidecar.adapters.<name> --describe, probed at boot by routes/sidecar_describe.rs::describe_sidecar — and that probe spawned the interpreter with a bare Command::new, no embedded-SDK injection.

Result on any host without pip install librefang-sdk:

• --describe fails with ModuleNotFoundError: No module named 'librefang';
• adapters without a hand-maintained static_fields fallback render an empty configure drawer — and that's telegram, ntfy, gotify, mastodon (channels.rs catalog: static_fields: None), i.e. the most common ones;
• the adapter source was embedded in the binary the whole time; only the describe probe couldn't see it.

Only feishu had a static_fields fallback (which must be hand-synced with the Python SCHEMA and drifts).

Fix

describe_sidecar now injects the embedded SDK exactly like the runtime spawn path, threading the kernel's authoritative home_dir (KernelApi::home_dir(), never a recomputed LIBREFANG_HOME) through populate_sidecar_schema_cache:

• librefang-channels: export embedded_sdk::pythonpath_with_embedded (pub mod + pub fn); only that one function becomes crate-public.
• routes/sidecar_describe.rs: describe_sidecar(command, args, home_dir) injects PYTHONPATH before spawning --describe. No-op when a real SDK install already wins (developer editable installs stay authoritative) or for non-Python commands.
• routes/channels.rs / server.rs: thread kernel.home_dir() to the boot probe.

Now the probe succeeds with just python3 on PATH and the dashboard gets each adapter's authoritative live schema with zero setup. static_fields drops back to a true last resort (no usable python3, or the embedded extract errored).

First-party adapter --describe is dependency-free — stdlib + the embedded librefang.sidecar only; telegram talks to the Bot API over urllib, no python-telegram-bot — so nothing third-party needs installing to populate the form.

Verification (Linux dev container: python3 3.13 present, librefang-sdk NOT installed)

• cargo test -p librefang-api --test sidecar_describe_test — 5/5 pass. The telegram and feishu probes now succeed and assert their real schema fields (TELEGRAM_BOT_TOKEN, FEISHU_APP_ID, …) instead of skipping with "SDK not installed" — direct end-to-end proof the embedded probe works without pip. The two -c failure-mode tests still surface their errors (injection is a no-op for their assertions).
• cargo check -p librefang-channels -p librefang-api --lib — clean.
• cargo clippy -p librefang-channels -p librefang-api --lib -- -D warnings — clean.
• cargo fmt --check — clean.

Scope

Independent of the goal-runner flake fix (#6083) and the Dependabot bump (#6080). The describe path is the only place that lacked the injection; the runtime spawn path already had it.