feat: deploy the agent — image, manifests, and the Flux plumbing

Two-stage Dockerfile: the runtime image carries neither uv nor a build
toolchain, runs as uid 10001, drops every capability and needs no writable
filesystem (verified with --read-only and no tmpfs).

k8s/ is what runs, dev/ is the Flux plumbing that applies it, self-managing
after three manual applies — the same shape every kong-* repo settled on.

Three choices worth naming:

- One namespace for the estate. What isolates an agent is its Keycloak client
  and the audiences it may request, not a namespace boundary.
- The GitRepository uses anonymous HTTPS rather than SSH with a Vault-held
  deploy key. The repo is already anonymously readable on gitea, so a key would
  guard nothing while adding two objects to create by hand before anything
  deploys. If the repos ever go private this becomes the kong-* SSH pattern.
- The lab CA certificate is committed. It is a certificate, never a key, and
  checking it in means the deployment has no hidden prerequisite.

replicas: 1 is a constraint, not a default — conversation history lives in the
process, so a second replica would route a user's "yes" to a pod that never saw
the question.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

k8s/deployment.yaml

@@ -0,0 +1,71 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: catalogue-agent
+  namespace: agents
+spec:
+  # One replica, and that is a constraint rather than a default. Conversation
+  # history — which the confirm-before-writing flow depends on — lives in the
+  # process, keyed by A2A contextId. A second replica would route the user's
+  # "yes" to a pod that never saw the question. Scaling out needs sticky routing
+  # on contextId or a shared store first.
+  replicas: 1
+  selector:
+    matchLabels:
+      app: catalogue-agent
+  template:
+    metadata:
+      labels:
+        app: catalogue-agent
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: agent
+          image: ghcr.io/staillanibm/classic-models-agent-catalogue:v0.1.0
+          ports:
+            - name: http
+              containerPort: 8080
+          envFrom:
+            - configMapRef:
+                name: catalogue-agent-config
+            - secretRef:
+                name: catalogue-agent-secrets
+          volumeMounts:
+            - name: sttlab-ca
+              mountPath: /etc/sttlab-ca
+              readOnly: true
+          # The Agent Card needs no auth and is served by the same app, so a 200
+          # means the A2A routes are genuinely mounted — not merely that the
+          # process is alive.
+          readinessProbe:
+            httpGet:
+              path: /.well-known/agent-card.json
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /.well-known/agent-card.json
+              port: http
+            initialDelaySeconds: 15
+            periodSeconds: 20
+          resources:
+            requests:
+              cpu: 50m
+              memory: 192Mi
+            limits:
+              cpu: "1"
+              memory: 512Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+      volumes:
+        - name: sttlab-ca
+          configMap:
+            name: sttlab-ca