feat: Railiance package and deploy (HARNESS-WP-0001-T06)

Container image, k8s namespace/deployment/smoke job, host venv install path,
and deterministic agent-harness smoke (sandbox commit+push+hub) for remote
verification without Claude Code on the worker host.

tests/test_smoke.py

@@ -0,0 +1,31 @@
+from __future__ import annotations
+
+import subprocess
+from pathlib import Path
+
+from agent_harness.smoke import run_smoke
+
+
+def _make_repo(tmp_path: Path) -> Path:
+    repo = tmp_path / "sandbox"
+    repo.mkdir()
+    subprocess.run(["git", "init", "-q"], cwd=repo, check=True)
+    (repo / "README.md").write_text("sandbox\n")
+    subprocess.run(["git", "add", "."], cwd=repo, check=True)
+    subprocess.run(
+        ["git", "-c", "user.email=t@t", "-c", "user.name=t", "commit", "-qm", "init"],
+        cwd=repo,
+        check=True,
+    )
+    return repo
+
+
+def test_run_smoke_commits_without_push(tmp_path: Path) -> None:
+    repo = _make_repo(tmp_path)
+    result = run_smoke(repo, report_to_hub=False, push=False)
+    assert result.run.ok is True
+    assert result.run.committed is True
+    assert (repo / "SMOKE.md").is_file()
+    assert result.pushed is False
+    metrics = repo / ".kaizen" / "metrics" / "coach" / "executions.jsonl"
+    assert metrics.is_file()