Bake L1 Torah into container images, simplify K8s deployment

L1 (29MB, 5860 files) is read-only and immutable — it belongs
inside the image, not on a separate volume. The scroll is sealed
in the aron. It ships with the vessel.

- All 4 Dockerfiles: COPY l1/ /mnt/torah/ in runtime stage
- deployment.yaml: Removed L1 PVC volume and all L1 volumeMounts
- deployment.yaml: Added imagePullSecrets for registry auth
- deployment.yaml: Manna uses emptyDir (kohen writes via kubectl cp)
- No CSI driver needed — eliminates Exoscale block storage dependency

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

deploy/k8s/deployment.yaml

@@ -1,16 +1,13 @@
 # Shorashim Deployment — the mishkan
 #
+# Shemot 40:33 — Vay'khal Mosheh et ham'lakhah.
+#
 # Architecture §5.1: All inter-component communication uses
 # JSON over Unix domain sockets or Erlang distribution protocol.
 # No HTTP between internal components.
 #
-# The vav_pipeline (BEAM) runs the Sanhedrin, Chatzotzrot,
-# AreiMiklat, EglahArufah, Bikurim, MannaLedger, ShabbatTimer.
-# The shoresh-engine runs as a sidecar (Erlang Port).
-# The talmudic_engine runs as a sidecar (Unix socket).
-# The korban_processor runs as a sidecar (invoked by pipeline).
-#
-# L1 is mounted read-only into all containers.
+# L1 Torah is baked into each container image (~29MB).
+# The scroll is sealed in the aron. It ships with the vessel.
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -32,18 +29,17 @@ spec:
     spec:
       # --- VOLUMES ---
       volumes:
-        - name: l1-torah
-          persistentVolumeClaim:
-            claimName: l1-torah-pvc
-            readOnly: true
         - name: manna
-          persistentVolumeClaim:
-            claimName: manna-pvc
+          emptyDir: {}
         - name: talmudic-socket
           emptyDir: {}
         - name: tmp-shorashim
           emptyDir: {}
 
+      # --- IMAGE PULL SECRET ---
+      imagePullSecrets:
+        - name: shorashim-registry
+
       # --- INIT CONTAINER: Run L3 migrations ---
       initContainers:
         - name: migrate
@@ -54,10 +50,6 @@ spec:
                 name: shorashim-config
             - secretRef:
                 name: shorashim-secrets
-          volumeMounts:
-            - name: l1-torah
-              mountPath: /mnt/torah
-              readOnly: true
 
       # --- CONTAINERS ---
       containers:
@@ -72,13 +64,7 @@ spec:
                 name: shorashim-config
             - secretRef:
                 name: shorashim-secrets
-          env:
-            - name: SHORESH_ENGINE_BINARY
-              value: "/home/shorashim/shoresh-engine"
           volumeMounts:
-            - name: l1-torah
-              mountPath: /mnt/torah
-              readOnly: true
             - name: manna
               mountPath: /var/lib/shorashim/manna
             - name: talmudic-socket
@@ -108,10 +94,6 @@ spec:
         # === SHORESH ENGINE (sidecar) ===
         - name: shoresh-engine
           image: exo.container-registry.com/the-recognition-protocol/shoresh-engine:latest
-          volumeMounts:
-            - name: l1-torah
-              mountPath: /mnt/torah
-              readOnly: true
           resources:
             requests:
               memory: "128Mi"
@@ -124,9 +106,6 @@ spec:
         - name: talmudic-engine
           image: exo.container-registry.com/the-recognition-protocol/talmudic-engine:latest
           volumeMounts:
-            - name: l1-torah
-              mountPath: /mnt/torah
-              readOnly: true
             - name: talmudic-socket
               mountPath: /tmp/shorashim
           resources:
@@ -140,10 +119,6 @@ spec:
         # === KORBAN PROCESSOR (sidecar) ===
         - name: korban-processor
           image: exo.container-registry.com/the-recognition-protocol/korban-processor:latest
-          volumeMounts:
-            - name: l1-torah
-              mountPath: /mnt/torah
-              readOnly: true
           resources:
             requests:
               memory: "128Mi"