feat: Railiance package and deploy (HARNESS-WP-0001-T06)

Container image, k8s namespace/deployment/smoke job, host venv install path,
and deterministic agent-harness smoke (sandbox commit+push+hub) for remote
verification without Claude Code on the worker host.

deploy/README.md

@@ -0,0 +1,55 @@
+# Railiance deployment (HARNESS-WP-0001-T06)
+
+Single shared harness instance on **railiance01**. Secrets stay on the host
+(Lanes 2–3); the container image is the portable runtime package.
+
+## Layout
+
+| Path | Role |
+|------|------|
+| `Containerfile` | Image: Python CLI + git + openssh; optional vendored llm-connect |
+| `deploy/k8s/railiance/` | Namespace, ConfigMap, Deployment, smoke Job |
+| `deploy/scripts/railiance-smoke.sh` | Host e2e: clone sandbox → commit → push → hub |
+| `agent-harness smoke` | Deterministic smoke (no Claude Code required) |
+
+## Prerequisites (done 2026-07-17)
+
+- Lane 2 deploy key on host + Forgejo write on `coulomb/executor-sandbox`
+- Lane 3 AppRole under `~/.local/agent-harness/approle-binky-mail`
+- `source ~/.local/agent-harness/env`
+- Hub: `http://127.0.0.1:18000` (ops-bridge) or in-cluster `state-hub.state-hub.svc`
+
+## Build & load image (workstation → railiance01)
+
+```bash
+# from agent-harness repo root
+make image                 # tags agent-harness:railiance01
+make image-export          # /tmp/agent-harness-railiance01.tar
+scp /tmp/agent-harness-railiance01.tar railiance01:/tmp/
+ssh railiance01 sudo k3s ctr images import /tmp/agent-harness-railiance01.tar
+```
+
+## Apply k8s
+
+```bash
+rsync -a deploy/k8s/railiance/ railiance01:agent-harness/deploy/k8s/railiance/
+ssh railiance01 kubectl apply -k agent-harness/deploy/k8s/railiance/
+ssh railiance01 kubectl -n agent-harness rollout status deploy/agent-harness
+```
+
+## Host smoke (authoritative e2e gate)
+
+Full path uses the host deploy key and hub bridge:
+
+```bash
+ssh railiance01 'bash ~/agent-harness/deploy/scripts/railiance-smoke.sh'
+```
+
+Expect: local commit + push to `executor-sandbox`, hub event `harness_smoke`,
+`.kaizen/metrics/coach/` on the sandbox checkout.
+
+## Personal follow-ups (not T06)
+
+- At **binky cutover only**: attach the same deploy key to `coulomb/binky-control`
+- Claude Code on the host (or hosted adapter) for real agentic sessions
+- T03 issue-core intake for scheduled task consumption