Bake L1 Torah into container images, simplify K8s deployment

L1 (29MB, 5860 files) is read-only and immutable — it belongs
inside the image, not on a separate volume. The scroll is sealed
in the aron. It ships with the vessel.

- All 4 Dockerfiles: COPY l1/ /mnt/torah/ in runtime stage
- deployment.yaml: Removed L1 PVC volume and all L1 volumeMounts
- deployment.yaml: Added imagePullSecrets for registry auth
- deployment.yaml: Manna uses emptyDir (kohen writes via kubectl cp)
- No CSI driver needed — eliminates Exoscale block storage dependency

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

deploy/docker/Dockerfile.vav_pipeline

@@ -51,8 +51,11 @@ WORKDIR /home/shorashim
 COPY --from=build --chown=shorashim:shorashim \
   /app/vav_pipeline/_build/prod/rel/vav_pipeline ./app
 
-# L1 mount point — read-only volume in production
-# Mounted at /mnt/torah in K8s, configured via L1_MOUNT_POINT env var
+# L1 Torah filesystem — baked into the image (read-only, ~29MB)
+# The scroll is sealed in the aron. It ships with the vessel.
+COPY --chown=shorashim:shorashim l1/ /mnt/torah/
+
+# L1 mount point
 ENV L1_MOUNT_POINT=/mnt/torah
 
 # Manna provision file location