Bake L1 Torah into container images, simplify K8s deployment

L1 (29MB, 5860 files) is read-only and immutable — it belongs
inside the image, not on a separate volume. The scroll is sealed
in the aron. It ships with the vessel.

- All 4 Dockerfiles: COPY l1/ /mnt/torah/ in runtime stage
- deployment.yaml: Removed L1 PVC volume and all L1 volumeMounts
- deployment.yaml: Added imagePullSecrets for registry auth
- deployment.yaml: Manna uses emptyDir (kohen writes via kubectl cp)
- No CSI driver needed — eliminates Exoscale block storage dependency

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

deploy/docker/Dockerfile.korban_processor

@@ -29,6 +29,10 @@ COPY --from=build --chown=shorashim:shorashim /app/ ./
 COPY --from=build /usr/local/lib/python3.12/site-packages/ /usr/local/lib/python3.12/site-packages/
 
 ENV PYTHONPATH=/home/shorashim/korban_processor/src
+
+# L1 Torah filesystem — baked into the image
+COPY --chown=shorashim:shorashim l1/ /mnt/torah/
+
 ENV L1_MOUNT_POINT=/mnt/torah
 
 # The korban processor is invoked by the vav_pipeline

deploy/docker/Dockerfile.shoresh_engine

@@ -40,7 +40,10 @@ WORKDIR /home/shorashim
 
 COPY --from=build /usr/local/bin/shoresh-engine ./shoresh-engine
 
-# L1 mount point — the engine reads Torah roots from L1
+# L1 Torah filesystem — baked into the image
+COPY --chown=shorashim:shorashim l1/ /mnt/torah/
+
+# L1 mount point
 ENV L1_MOUNT_POINT=/mnt/torah
 
 # The engine is invoked as an Erlang Port by vav_pipeline

deploy/docker/Dockerfile.talmudic_engine

@@ -21,7 +21,10 @@ WORKDIR /home/shorashim/talmudic_engine
 
 COPY --from=build --chown=shorashim:shorashim /app/ ./
 
-# L1 mount point — Prolog reads Torah for mitzvot and root data
+# L1 Torah filesystem — baked into the image
+COPY --chown=shorashim:shorashim l1/ /mnt/torah/
+
+# L1 mount point
 ENV L1_MOUNT_POINT=/mnt/torah
 
 # Socket path for communication with vav_pipeline

deploy/docker/Dockerfile.vav_pipeline

@@ -51,8 +51,11 @@ WORKDIR /home/shorashim
 COPY --from=build --chown=shorashim:shorashim \
   /app/vav_pipeline/_build/prod/rel/vav_pipeline ./app
 
-# L1 mount point — read-only volume in production
-# Mounted at /mnt/torah in K8s, configured via L1_MOUNT_POINT env var
+# L1 Torah filesystem — baked into the image (read-only, ~29MB)
+# The scroll is sealed in the aron. It ships with the vessel.
+COPY --chown=shorashim:shorashim l1/ /mnt/torah/
+
+# L1 mount point
 ENV L1_MOUNT_POINT=/mnt/torah
 
 # Manna provision file location