temporal-engine subchart (off by default), with the RBAC the engine needs

[DavidNic11]

Fourth PR in the sequence from #194 (ADR 0036), following #196 and #197. Adds the temporal-engine subchart.

enabled: false, so this changes no behaviour. It's the last PR in the sequence that doesn't.

Enabling the engine is deliberately two steps:

temporal-engine:
  enabled: true                    # 1. deploy worker + gateway
agent-orchestrator:
  config:
    agentEngine: temporal          # 2. route turns to it

Step 1 alone changes nothing, which is what makes the rollout reversible — the engine can be deployed, watched and rolled back before a single turn depends on it.

Takes a Temporal address rather than bundling a server, so enabling it adds no stateful component. (That was the strongest argument against this whole thing; it doesn't apply, since the platform already runs Temporal.)

The part worth actual scrutiny: RBAC

The chart arrived from the fork granting only toolruns create/get, which was true when it was written and isn't now. templates/rbac.yaml adds:

• secrets create/get/update/patch. This grant is the mechanism that keeps credentials out of Temporal's event history: the authorization pre-flight writes resolved values into a Secret and returns only the object's name, so nothing a workflow can see holds credential material and the kubelet is the only reader. Without this grant the engine cannot resolve a per-user credential at all.
• agentruns create/get, granted only when the NATS bridge is enabled — bridged pod agents launch the ordinary AgentRun an unmodified upstream agent expects.
• integrationroutes get/list/watch, on a new gateway ServiceAccount. The gateway watches routes for deterministic dispatch and previously ran with no identity at all.

Each mirrors a grant agent-orchestrator already holds, so enabling the engine doesn't widen the release's blast radius — it gives an equivalent one to a second workload. Worth checking that claim rather than taking it.

Values reused rather than duplicated

Defaults point at the orchestrator's own OPENAI_API_KEY secret and the shared callback secret, so one key serves both engines. catalog.namespace defaults to the release namespace instead of a hardcoded one.

qdrant.collectionPrefix defaults to te-, and the reason is in the values file: both engines index tools/skills/agents with different payload schemas, so a shared collection would have each reading records it cannot decode. Prefixing keeps them side by side in one instance.

This adds the first CI job that renders charts/agent-controller at all

Nothing in CI templated this chart before, so a broken subchart template would ship silently — that's true of the other three subcharts today and remains so; this PR only covers the new one.

Rendered standalone rather than through the umbrella chart, because the parent pulls open-webui and nats from remote repos and templating it needs a helm dependency build plus a network round trip to validate a subchart that has neither.

Both shapes are checked, and the second one is the point: defaults must render the minimum (no catalog-sync without Qdrant, no agentruns grant without the bridge), and everything-on must render at all — an optional block that only breaks when enabled is the one nobody notices.

Fork residue dropped

docs/platform/ (a Bitovi-specific ArgoCD + ECR deployment kit) and the Makefile's ecr-push target. The Makefile now just runs the same four checks CI does.

What this PR does not do

It doesn't enable anything. The next step — flipping agentEngine to temporal — needs the e2e/ suite run under AGENT_ENGINE=temporal, and that hasn't happened. 581 unit tests passing is precisely the evidence ADR 0030 says isn't enough: "none of the defects above were visible to unit tests; every one required the assembled system to be running."

Locally: helm lint clean, both renders parse, engine module green (12 packages), orchestrator 581 tests + typecheck clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_018Uj1SJ41DJJ8woZM7fd3DQ

[imaustink]

🚢 I triggered the jobs again