feat: deploy the Approvisionnement facade

The adapter runs in the agents namespace with the other agents, not with n8n:
what it is, is an agent, and the workflow behind it is an implementation detail
its callers never see.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deploy/agents/approvisionnement.yaml

@@ -0,0 +1,103 @@
+# The A2A facade for Approvisionnement. It lives in the `agents` namespace with
+# the other agents, not with n8n: what it is, is an agent — the workflow behind
+# it is an implementation detail its callers never see.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: approvisionnement-agent
+  namespace: agents
+spec:
+  # The adapter is stateless — every task is one webhook call — so this is a
+  # default rather than a constraint. What is not replicable is n8n behind it.
+  replicas: 1
+  selector:
+    matchLabels:
+      app: approvisionnement-agent
+  template:
+    metadata:
+      labels:
+        app: approvisionnement-agent
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: adapter
+          image: gitea.sttlab.eu/stt/a2a-n8n-adapter:v0.1.0
+          ports:
+            - name: http
+              containerPort: 8080
+          env:
+            - name: ADAPTER_AGENT_NAME
+              value: approvisionnement
+            - name: ADAPTER_AGENT_DESCRIPTION
+              value: >-
+                Supply decisions for the Classic Models catalog. Answers whether a
+                reference can be promised, from stock on hand. Holds no standing
+                access of its own.
+            - name: ADAPTER_SKILL_ID
+              value: check_availability
+            - name: ADAPTER_SKILL_NAME
+              value: Check availability
+            - name: ADAPTER_SKILL_DESCRIPTION
+              value: >-
+                Decide whether a product reference can be promised. Name the
+                reference in the question, as S10_1949. Returns a decision and the
+                reason for it, never the stock table.
+            - name: ADAPTER_SKILL_EXAMPLES
+              value: |
+                Can we promise S10_1949?
+                Is S18_3782 close to a reorder?
+            - name: ADAPTER_WEBHOOK_URL
+              value: http://n8n.n8n.svc.cluster.local/webhook/check-availability
+            - name: ADAPTER_PUBLIC_URL
+              value: http://approvisionnement-agent.agents.svc.cluster.local:8080/
+            - name: ADAPTER_CA_BUNDLE
+              value: /etc/sttlab-ca/ca.crt
+          volumeMounts:
+            - name: sttlab-ca
+              mountPath: /etc/sttlab-ca
+              readOnly: true
+          readinessProbe:
+            httpGet:
+              path: /.well-known/agent-card.json
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /.well-known/agent-card.json
+              port: http
+            initialDelaySeconds: 15
+            periodSeconds: 20
+          resources:
+            requests:
+              cpu: 20m
+              memory: 96Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+      volumes:
+        - name: sttlab-ca
+          configMap:
+            name: sttlab-ca
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: approvisionnement-agent
+  namespace: agents
+spec:
+  selector:
+    app: approvisionnement-agent
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http

deploy/agents/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - approvisionnement.yaml