Package canned-prompts for Railiance

Registers the repo with State Hub (agents / practice, prefix RCP-WP) and fills
in the rapp shape.

declarations/rapp.yaml declares a manifest-managed platform service owned by
canned-prompts, bound to rail-kubernetes and reef-railiance, with rollout,
smoke and rollback contracts.

The image pin says `pending-publication` rather than carrying a placeholder
digest. The image builds and was verified locally (canned-prompts
CANP-WP-0006-T06) but has never been pushed, so no registry digest exists. A
placeholder shaped like a real digest would be worse than a sentinel: it could
be mistaken for something deployable.

manifests/ follows the rapp-sbom-nexus shape: namespace labelled for the
postgres client, external secrets from OpenBao, a migration Job, and the
runtime Deployment with a ClusterIP-only Service, dedicated ServiceAccount and
default-deny plus runtime NetworkPolicies.

Three choices worth stating. Credentials arrive as mounted files, never env
vars — an env var holding a password is visible in kubectl describe, in crash
dumps, and to anything that can read /proc. Migrations run as a Job rather than
at start-up, so a schema rollback stays separate from a code rollback and
replicas do not race. Liveness points at /healthz, which checks only that the
process is up: pointing it at a database-dependent path would restart every
replica during a database blip.

Egress is PostgreSQL and DNS only. A package arrives by publish; the registry
never reaches out, so it is given no path to.

tools/smoke.sh checks what only the cluster can answer and calls
canned-prompts' service/tools/smoke.py for health and migration head, rather
than holding a second opinion about whether the service is healthy.

RCP-WP-0002 carries the two operator actions that block a first rollout —
publishing the image and provisioning database roles — and records
per-publisher identity as a decision belonging upstream, which this repo must
not paper over with cluster configuration implying finer control than exists.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Bjefh8NUiEiahN4JLwoSKM

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 388925@bnt-lap001
Assistant-Session: 3507023f-e0fd-4a1e-9d90-a0d4217d1502

manifests/migration.yaml

@@ -0,0 +1,64 @@
+# Schema migration as a Job, not an init container and not a start-up hook.
+# Running migrations at start-up races between replicas and couples a rollback
+# of the code to a rollback of the schema. The Job name carries the target
+# revision so a re-apply at the same revision is a no-op rather than a rerun.
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: canned-prompts-schema-migration-0002
+  namespace: canned-prompts
+  labels:
+    app.kubernetes.io/name: canned-prompts-migration
+    app.kubernetes.io/component: migration
+spec:
+  backoffLimit: 2
+  ttlSecondsAfterFinished: 86400
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: canned-prompts-migration
+    spec:
+      automountServiceAccountToken: false
+      restartPolicy: Never
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        fsGroup: 10001
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: migrate
+          # REPLACE on first publication — see declarations/rapp.yaml.
+          image: forgejo.coulomb.social/coulomb/canned-prompts:pending-publication
+          command: ["alembic"]
+          args: ["upgrade", "head"]
+          workingDir: /app
+          env:
+            # The migration role owns the schema; the runtime role does not.
+            - name: CANNED_PROMPTS_DATABASE_URL_FILE
+              value: /var/run/secrets/postgres-migration/url
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            readOnlyRootFilesystem: true
+          resources:
+            requests:
+              cpu: 25m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+          volumeMounts:
+            - name: postgres-migration
+              mountPath: /var/run/secrets/postgres-migration
+              readOnly: true
+      volumes:
+        - name: postgres-migration
+          secret:
+            defaultMode: 0440
+            secretName: canned-prompts-postgres-migration
+            items:
+              - key: url
+                path: url