feat: Railiance package and deploy (HARNESS-WP-0001-T06)

Container image, k8s namespace/deployment/smoke job, host venv install path,
and deterministic agent-harness smoke (sandbox commit+push+hub) for remote
verification without Claude Code on the worker host.

deploy/k8s/railiance/deployment.yaml

@@ -0,0 +1,52 @@
+# Long-lived instance placeholder until T03 task intake polls issue-core.
+# Keeps one ready replica with harness CLI + git tools; no LLM session here.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: agent-harness
+  namespace: agent-harness
+  labels:
+    app.kubernetes.io/name: agent-harness
+    app.kubernetes.io/part-of: agent-harness
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: agent-harness
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: agent-harness
+        app.kubernetes.io/part-of: agent-harness
+    spec:
+      securityContext:
+        fsGroup: 10001
+      containers:
+        - name: agent-harness
+          image: agent-harness:railiance01
+          imagePullPolicy: Never
+          command: ["sleep", "infinity"]
+          envFrom:
+            - configMapRef:
+                name: agent-harness-config
+          resources:
+            requests:
+              cpu: 25m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 10001
+            runAsGroup: 10001
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: tmp
+          emptyDir: {}