Phase 5 deployment: Dockerfiles, K8s manifests, halt monitor (Steps 33, 36)

Shemot 40:33 — Vay'khal Moshe et ham'lakhah.
The builder completes the work. The vessel is ready for transport.

Step 33 — Deployment configuration:
- Dockerfiles for all 4 components:
  - vav_pipeline: Elixir 1.16.1/OTP 26.2.1 release with Sanhedrin
  - shoresh_engine: GHC 9.6.4 binary
  - talmudic_engine: SWI-Prolog 9.2.2
  - korban_processor: Python 3.12.2 with pydantic
- Kubernetes manifests for Exoscale SKS (ch-gva-2):
  - Namespace, ConfigMap, Secrets template
  - L1 Torah PV/PVC (read-only mount)
  - Manna provision PVC (kohen writes, system reads)
  - Deployment: vav-pipeline + 3 sidecars, shared volumes
  - Service: ClusterIP + LoadBalancer with Exoscale NLB
  - Init container runs Ecto migrations (VavPipeline.Release)

Step 36 — Halt monitor (esh tamid):
- GenServer watches for three cardinal sins
- halt!/3 immediately halts system, sounds Chatzotzrot war signal
- Permanent audit log — halt events never deleted
- resolve/1 requires explicit operator action to resume
- alive?/0 for morning tamid verification
- 13 tests: alive check, 3 halt types, resolution, audit log,
  chatzotzrot war signal integration
- Added to supervision tree

All 219 Elixir + 19 L3 + 195 Prolog + 33 Haskell = 447+ tests, 0 failures

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

deploy/docker/Dockerfile.vav_pipeline

@@ -0,0 +1,68 @@
+# Shorashim Vav Pipeline — Elixir/OTP release with Sanhedrin
+# Construction spec §1.1: Elixir 1.16.1, OTP 26.2.1
+# The pipeline and Sanhedrin run in the same BEAM VM.
+
+# === BUILD STAGE ===
+FROM hexpm/elixir:1.16.1-erlang-26.2.1-ubuntu-jammy-20240125 AS build
+
+RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+# Copy Sanhedrin (Erlang dep, referenced as path dep from vav_pipeline)
+COPY sanhedrin/ sanhedrin/
+
+# Copy Vav Pipeline
+COPY vav_pipeline/ vav_pipeline/
+
+WORKDIR /app/vav_pipeline
+
+# Fetch deps and compile in prod mode
+ENV MIX_ENV=prod
+RUN mix local.hex --force && \
+    mix local.rebar --force && \
+    mix deps.get --only prod && \
+    mix compile
+
+# Build OTP release
+RUN mix release
+
+# === RUNTIME STAGE ===
+FROM ubuntu:jammy-20240125
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+      libstdc++6 openssl ca-certificates locales && \
+    rm -rf /var/lib/apt/lists/* && \
+    sed -i '/en_US.UTF-8/s/^# //g' /etc/locale.gen && \
+    locale-gen
+
+ENV LANG=en_US.UTF-8
+ENV LANGUAGE=en_US:en
+ENV LC_ALL=en_US.UTF-8
+
+# Non-root user — the system serves, it does not own
+RUN useradd --create-home --shell /bin/bash shorashim
+USER shorashim
+
+WORKDIR /home/shorashim
+
+# Copy the release
+COPY --from=build --chown=shorashim:shorashim \
+  /app/vav_pipeline/_build/prod/rel/vav_pipeline ./app
+
+# L1 mount point — read-only volume in production
+# Mounted at /mnt/torah in K8s, configured via L1_MOUNT_POINT env var
+ENV L1_MOUNT_POINT=/mnt/torah
+
+# Manna provision file location
+ENV MANNA_PROVISION_FILE=/var/lib/shorashim/manna/today.json
+
+# PostgreSQL connection for L3
+# Set DATABASE_URL in production deployment
+# ENV DATABASE_URL=
+
+# Health check port
+EXPOSE 4000
+
+CMD ["./app/bin/vav_pipeline", "start"]