Bake L1 Torah into container images, simplify K8s deployment

L1 (29MB, 5860 files) is read-only and immutable — it belongs
inside the image, not on a separate volume. The scroll is sealed
in the aron. It ships with the vessel.

- All 4 Dockerfiles: COPY l1/ /mnt/torah/ in runtime stage
- deployment.yaml: Removed L1 PVC volume and all L1 volumeMounts
- deployment.yaml: Added imagePullSecrets for registry auth
- deployment.yaml: Manna uses emptyDir (kohen writes via kubectl cp)
- No CSI driver needed — eliminates Exoscale block storage dependency

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

deploy/docker/Dockerfile.shoresh_engine

@@ -40,7 +40,10 @@ WORKDIR /home/shorashim
 
 COPY --from=build /usr/local/bin/shoresh-engine ./shoresh-engine
 
-# L1 mount point — the engine reads Torah roots from L1
+# L1 Torah filesystem — baked into the image
+COPY --chown=shorashim:shorashim l1/ /mnt/torah/
+
+# L1 mount point
 ENV L1_MOUNT_POINT=/mnt/torah
 
 # The engine is invoked as an Erlang Port by vav_pipeline