feat(api): add GET /api/v1/pods/{name}/manifest endpoint (issue #80)

[dndungu]

Summary

Adds GET /api/v1/pods/{name}/manifest, returning the exact manifest bytes that were submitted for a pod. Issue #80 (a pod's reported status diverged from its actual container after a crash-restart under resource pressure) notes that when that happens, an operator has no way to recreate the pod faithfully: GET /api/v1/pods/{name} returns only a status summary, and /manifest 404ed. This is quick win 1 of that issue -- an independent fix that doesn't require the state-divergence root cause itself to be understood or fixed (that's tracked separately, E6 in docs/plan.md).

Changes

• internal/state/store.go, internal/state/sqlite.go: PodRecord gains a RawManifest []byte field plus a SetRawManifest setter (mirrors the existing SourcePath/SetSourcePath pattern), persisted via a new manifest_raw SQLite column added through the existing ensureColumn migration helper. This is necessary because the store's existing spec_json column is a re-serialization of the parsed PodSpec, not the original submission -- round-tripping YAML through the struct loses key order, comments, and any field the parser doesn't retain, so it can't satisfy "byte-equivalent" on its own.
• internal/api/pods_mutate.go, internal/bus/handler_apply.go, cmd/spark/main.go: each of the three places a pod can be applied (HTTP POST /api/v1/pods, the NATS req.spark.apply handler, and the manifest directory watcher) now calls SetRawManifest with the raw bytes it already has in scope, so the new endpoint works no matter how the pod was created.
• internal/api/pods_manifest.go: the new GET /api/v1/pods/{name}/manifest handler. Writes RawManifest verbatim (text/plain, no JSON envelope). Deliberately not filtered by pod status -- it has to work for a pod stuck in any state, including a divergent one, since that's exactly when an operator needs it. 404 matches the existing GET /api/v1/pods/{name} not-found shape.
• README.md: documents the new endpoint alongside the existing Get Pod section.
• docs/lore.md (new file): records a YAML-parser landmine found while writing this PR's tests -- a containers: list indented at the same column as its parent key silently parses to zero containers instead of erroring. This is the already-fixed root cause of issue Pod completes instantly (exitCode=0) with zero container startup — container spec silently dropped #77 (PR fix(manifest): parse same-indent block sequences instead of dropping them (issue #77) #90); recorded here as a general landmine for the next person hand-writing a test fixture, not because this repo is still carrying the bug.

Deviation worth flagging: two earlier attempts at this same goal (via kazi, this repo's grind-to-predicates tool) converged but were rejected on manual review -- both returned a JSON-wrapped reconstruction of the parsed PodSpec rather than the literal submitted bytes, which doesn't satisfy "byte-equivalent modulo whitespace" and would drop anything the parser doesn't retain (comments, key order, fields outside the tracked subset). This PR's implementation was hand-authored after that finding. It kept the route-registration/404-handling scaffold and the lore.md finding from those attempts, but replaced the response body and rewrote the tests to assert real byte-equality against the original POST body instead of individual struct fields.

Testing

• go build ./..., go vet ./..., staticcheck ./... -- all clean.
• go test ./... -race -timeout 120s -count=1 -- all 13 packages pass, no regressions.
• New tests in internal/api/pods_manifest_test.go, all exercising the real HTTP handler via httptest + srv.ServeHTTP (never calling store.Apply directly):
  • TestGetPodManifest: POSTs a YAML pod manifest, GETs /manifest, asserts the response body is byte-equal (modulo whitespace) to the original POST body.
  • TestGetPodManifestJSON: same, for a JSON submission (issue POST /api/v1/pods with JSON body returns 201 {"pods":null} and creates nothing #74's content-type path), confirming the endpoint doesn't always re-render as YAML.
  • TestGetPodManifestNotFound: 404 with the standard error shape for a pod that was never applied.
• Verified via kazi's own predicate checker (kazi apply <proposal> --workspace <this branch's worktree> --check --json) against the final commits: all 10 acceptance/guard predicates pass, including a negative-space check that the found-case test genuinely POSTs through the real handler rather than seeding the pod via a direct store call.
• Not yet live-verified against the DGX -- that's the coordinating session's job post-merge/deploy per this repo's dispatch convention. Recipe: submit a pod manifest to the live Spark API, then curl GET /api/v1/pods/{name}/manifest and confirm the body byte-matches the submitted manifest modulo whitespace.

Linked issues / tasks

• Issue Pod state diverges from container reality after crash-restart under resource pressure: pod 'pending' while its container is alive and serving #80 (pod status diverged from its actual container after a crash-restart under resource pressure) -- this PR covers only "quick win 1" (the missing manifest endpoint) called out in that issue. Quick win 2 (a signedness bug in the free-GPU shortfall calculation) already shipped separately in fix(scheduler): floor non-CPU resource availability at 0 (issue #80) #95. The state-divergence root cause itself is not addressed here; it's tracked as its own follow-up (E6 in docs/plan.md).
• docs/plan.md tasks T4.7/T4.8 (E4 epic), verifies UC-110 in .claude/scratch/usecases-manifest.json.