feat: deploy the agent — image, manifests, and the Flux plumbing

Two-stage Dockerfile: the runtime image carries neither uv nor a build
toolchain, runs as uid 10001, drops every capability and needs no writable
filesystem (verified with --read-only and no tmpfs).

k8s/ is what runs, dev/ is the Flux plumbing that applies it, self-managing
after three manual applies — the same shape every kong-* repo settled on.

Three choices worth naming:

- One namespace for the estate. What isolates an agent is its Keycloak client
  and the audiences it may request, not a namespace boundary.
- The GitRepository uses anonymous HTTPS rather than SSH with a Vault-held
  deploy key. The repo is already anonymously readable on gitea, so a key would
  guard nothing while adding two objects to create by hand before anything
  deploys. If the repos ever go private this becomes the kong-* SSH pattern.
- The lab CA certificate is committed. It is a certificate, never a key, and
  checking it in means the deployment has no hidden prerequisite.

replicas: 1 is a constraint, not a default — conversation history lives in the
process, so a second replica would route a user's "yes" to a pod that never saw
the question.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

k8s/externalsecret.yaml

@@ -0,0 +1,24 @@
+# The agent's Keycloak client secret, and nothing else. It comes from the same
+# Vault entry the realm import reads, so there is exactly one copy of this
+# secret in the estate and rotating it in Vault rotates it everywhere.
+#
+# vault-keycloak rather than a store of the agents' own: this value is a
+# Keycloak client secret, owned by the realm, and inventing a second AppRole to
+# read the same path would add a credential without adding a boundary.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: catalogue-agent-secrets
+  namespace: agents
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-keycloak
+  target:
+    name: catalogue-agent-secrets
+  data:
+    - secretKey: CATALOGUE_CLIENT_SECRET
+      remoteRef:
+        key: keycloak/classic-models-realm
+        property: KC_SECRET_CLASSIC_MODELS_AGENT_CATALOGUE