WP-0011: deploy scaffolding for revenue.coulomb.social

Record T01 package (in-repo k8s/railiance, combined /ui + API app,
dedicated CNPG). Add Dockerfile, healthz, migration/bootstrap scripts,
kustomize manifests, ArgoCD Application (in railiance-platform), and
docs/deployment.md. T05 left open for operator DNS/OpenBao/image push.

Dockerfile

@@ -0,0 +1,31 @@
+# Target Revenue Trust Service + Control Plane (WP-0011).
+# Image: forgejo.coulomb.social/coulomb/target-revenue
+FROM python:3.12-slim AS runtime
+
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    HOME=/home/app
+
+RUN useradd --create-home --home-dir /home/app --uid 10001 app
+
+WORKDIR /src
+COPY pyproject.toml README.md LICENSE ./
+COPY src/target_revenue ./src/target_revenue
+COPY migrations ./migrations
+COPY schemas ./schemas
+COPY specs/policies ./specs/policies
+COPY specs/profiles ./specs/profiles
+
+RUN pip install --no-cache-dir --index-url https://pypi.org/simple ".[service]" \
+    && chown -R app:app /src
+
+COPY scripts/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+COPY scripts/apply_migrations.py /usr/local/bin/apply_migrations.py
+COPY scripts/bootstrap_binky.py /usr/local/bin/bootstrap_binky.py
+RUN chmod +x /usr/local/bin/docker-entrypoint.sh \
+              /usr/local/bin/apply_migrations.py \
+              /usr/local/bin/bootstrap_binky.py
+
+USER app
+EXPOSE 8000
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]