feat: deploy the agent — image, manifests, and the Flux plumbing

Two-stage Dockerfile: the runtime image carries neither uv nor a build
toolchain, runs as uid 10001, drops every capability and needs no writable
filesystem (verified with --read-only and no tmpfs).

k8s/ is what runs, dev/ is the Flux plumbing that applies it, self-managing
after three manual applies — the same shape every kong-* repo settled on.

Three choices worth naming:

- One namespace for the estate. What isolates an agent is its Keycloak client
  and the audiences it may request, not a namespace boundary.
- The GitRepository uses anonymous HTTPS rather than SSH with a Vault-held
  deploy key. The repo is already anonymously readable on gitea, so a key would
  guard nothing while adding two objects to create by hand before anything
  deploys. If the repos ever go private this becomes the kong-* SSH pattern.
- The lab CA certificate is committed. It is a certificate, never a key, and
  checking it in means the deployment has no hidden prerequisite.

replicas: 1 is a constraint, not a default — conversation history lives in the
process, so a second replica would route a user's "yes" to a pod that never saw
the question.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

k8s/configmap.yaml

@@ -0,0 +1,26 @@
+# Everything here is an endpoint or a public identifier. The one secret the
+# agent holds arrives through catalogue-agent-secrets; nothing in this file is
+# sensitive, which is the point of keeping the split visible.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: catalogue-agent-config
+  namespace: agents
+data:
+  CATALOGUE_KEYCLOAK_REALM_URL: https://keycloak.sttlab.local/realms/classic-models
+  CATALOGUE_CLIENT_ID: classic-models-agent-catalogue
+
+  CATALOGUE_MCP_CATALOG_URL: https://catalog-dev.sttlab.local/catalog-mcp
+  CATALOGUE_MCP_SALES_URL: https://sales-dev.sttlab.local/sales-mcp
+
+  CATALOGUE_LLM_BASE_URL: https://llm-dev.sttlab.local/llm/v1
+  CATALOGUE_LLM_MODEL: google/gemini-3.7-flash
+
+  # Trust the lab CA rather than disabling verification. Mounted from the
+  # sttlab-ca ConfigMap.
+  CATALOGUE_CA_BUNDLE: /etc/sttlab-ca/ca.crt
+
+  # What other agents dial, so it is the Service DNS name and not the bind
+  # address. It is advertised in the Agent Card; get it wrong and A2A callers
+  # are pointed at nothing.
+  CATALOGUE_PUBLIC_URL: http://catalogue-agent.agents.svc.cluster.local:8080/