feat: deploy the Approvisionnement facade

The adapter runs in the agents namespace with the other agents, not with n8n:
what it is, is an agent, and the workflow behind it is an implementation detail
its callers never see.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

adapter/.dockerignore

@@ -0,0 +1,8 @@
+.venv/
+.git/
+.pytest_cache/
+__pycache__/
+*.pyc
+tests/
+k8s/
+dev/

adapter/Dockerfile

@@ -0,0 +1,42 @@
+# Two stages so the runtime image carries no build toolchain and no uv.
+FROM python:3.12-slim AS build
+
+COPY --from=ghcr.io/astral-sh/uv:0.9.7 /uv /bin/uv
+
+ENV UV_COMPILE_BYTECODE=1 \
+    UV_LINK_MODE=copy \
+    UV_PYTHON_DOWNLOADS=never
+
+WORKDIR /app
+
+COPY pyproject.toml README.md ./
+COPY src ./src
+
+# One step, no lockfile: the version floors in pyproject.toml are what pins this,
+# and they are deliberately recent (August 2026) to keep the vulnerability
+# surface small. Add a uv.lock when the build needs to be byte-reproducible.
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv venv /app/.venv && uv pip install --python /app/.venv/bin/python .
+
+FROM python:3.12-slim AS runtime
+
+# Non-root, no shell login, no home to write to. The agent holds a Keycloak
+# client secret in its environment; a container that cannot be written to is one
+# less way to read it back out.
+RUN useradd --system --uid 10001 --no-create-home --shell /usr/sbin/nologin agent
+
+WORKDIR /app
+COPY --from=build /app/.venv /app/.venv
+ENV PATH="/app/.venv/bin:$PATH" \
+    PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1
+
+USER 10001
+EXPOSE 8080
+
+# The Agent Card is the natural health endpoint: it is served by the same app,
+# needs no auth, and a 200 means the A2A routes are actually mounted.
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD ["python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8080/.well-known/agent-card.json', timeout=4).status==200 else 1)"]
+
+ENTRYPOINT ["python", "-m", "a2a_n8n_adapter"]