feat: Railiance package and deploy (HARNESS-WP-0001-T06)

Container image, k8s namespace/deployment/smoke job, host venv install path,
and deterministic agent-harness smoke (sandbox commit+push+hub) for remote
verification without Claude Code on the worker host.

deploy/k8s/railiance/job-smoke.yaml

@@ -0,0 +1,47 @@
+# One-shot smoke Job. Prefer host-level smoke (deploy/scripts/railiance-smoke.sh)
+# when deploy keys live on the host. This Job is for image/k8s path verification
+# with --no-push (no deploy key in-cluster yet).
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: agent-harness-smoke
+  namespace: agent-harness
+  labels:
+    app.kubernetes.io/name: agent-harness
+    app.kubernetes.io/component: smoke
+spec:
+  ttlSecondsAfterFinished: 600
+  backoffLimit: 1
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: agent-harness
+        app.kubernetes.io/component: smoke
+    spec:
+      restartPolicy: Never
+      securityContext:
+        fsGroup: 10001
+      containers:
+        - name: smoke
+          image: agent-harness:railiance01
+          imagePullPolicy: Never
+          args:
+            - "profiles"
+          envFrom:
+            - configMapRef:
+                name: agent-harness-config
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 10001
+            runAsGroup: 10001