feat(k8s): production parity — workers, MinIO, pull secrets, CI render gate

[alovladi007]

Why

The k8s manifests deployed the four HTTP services but none of the machinery behind them. In a real cluster:

• No workers — async analysis runs (CVD/diffusion/oxidation), scheduled tasks, and process-control job execution would be accepted by the APIs and never executed.
• No object storage — attachments, CSV exports, and telemetry blobs had no in-cluster destination (only the backup CronJob referenced MinIO).
• No pull credentials — the ghcr images are private; every pod would sit in ImagePullBackOff.

What

Piece	Detail
workers.yaml	celery-worker (analysis queues, 2 replicas), celery-beat (1 replica, Recreate — two beats double-fire every periodic task), pc-worker (ion/rtp queues). Compose-parity env including broker on redis DB 2; non-root, read-only rootfs, celery inspect ping liveness; beat writes its schedule to /tmp.
minio.yaml	Standalone StatefulSet (20Gi PVC) + Service + idempotent minio-init Job — bucket create + mc ilm import of the canonical lifecycle policy (telemetry 90d, exports 7d, multipart-abort 1d). Comment documents the managed-S3 alternative.
Env wiring	OBJECT_STORE_* / AWS_* added to analysis + lims (compose parity); minio-credentials secretGenerator + template.
Pull secrets	All four ServiceAccounts reference ghcr-pull-secret; the template documents the one-time kubectl create secret docker-registry command per cluster.
cd.yml	Deploy step pins worker deployments to the released tag (they share the analysis/process-control images) and waits on celery-worker rollout.
ci.yml	New k8s-manifests job renders both overlays with kubectl kustomize, wired into the CI Status aggregate — the deploy job's "manifests validated in CI" notice is now actually true.

Proof

• Both overlays render clean locally; all five new workloads present in rendered output
• Secrets guardrail passes (templates carry only placeholders)

After this merges, no code stands between the repo and a live deploy — the remaining steps are provisioning: cluster, domain/TLS, real secret values, and the KUBE_CONFIG GitHub secret.

🤖 Generated with Claude Code