Phase 5 deployment: Dockerfiles, K8s manifests, halt monitor (Steps 33, 36)

Shemot 40:33 — Vay'khal Moshe et ham'lakhah.
The builder completes the work. The vessel is ready for transport.

Step 33 — Deployment configuration:
- Dockerfiles for all 4 components:
  - vav_pipeline: Elixir 1.16.1/OTP 26.2.1 release with Sanhedrin
  - shoresh_engine: GHC 9.6.4 binary
  - talmudic_engine: SWI-Prolog 9.2.2
  - korban_processor: Python 3.12.2 with pydantic
- Kubernetes manifests for Exoscale SKS (ch-gva-2):
  - Namespace, ConfigMap, Secrets template
  - L1 Torah PV/PVC (read-only mount)
  - Manna provision PVC (kohen writes, system reads)
  - Deployment: vav-pipeline + 3 sidecars, shared volumes
  - Service: ClusterIP + LoadBalancer with Exoscale NLB
  - Init container runs Ecto migrations (VavPipeline.Release)

Step 36 — Halt monitor (esh tamid):
- GenServer watches for three cardinal sins
- halt!/3 immediately halts system, sounds Chatzotzrot war signal
- Permanent audit log — halt events never deleted
- resolve/1 requires explicit operator action to resume
- alive?/0 for morning tamid verification
- 13 tests: alive check, 3 halt types, resolution, audit log,
  chatzotzrot war signal integration
- Added to supervision tree

All 219 Elixir + 19 L3 + 195 Prolog + 33 Haskell = 447+ tests, 0 failures

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

deploy/k8s/service.yaml

@@ -0,0 +1,48 @@
+# Shorashim Services
+# Operations spec §1.1: Four access tiers
+#   - Pe'ah (public, no auth)
+#   - Machaneh Leviyah (authenticated)
+#   - Chatzer (full access)
+#   - Kodesh (operator, mTLS)
+#
+# All tiers go through a single Service → vav-pipeline port 4000
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: shorashim
+  namespace: shorashim
+  labels:
+    app.kubernetes.io/name: shorashim
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: shorashim
+  ports:
+    - port: 80
+      targetPort: 4000
+      protocol: TCP
+      name: http
+---
+# External access via LoadBalancer
+# For Exoscale SKS, this provisions an Exoscale NLB
+apiVersion: v1
+kind: Service
+metadata:
+  name: shorashim-external
+  namespace: shorashim
+  labels:
+    app.kubernetes.io/name: shorashim
+  annotations:
+    # Exoscale NLB annotations
+    service.beta.kubernetes.io/exoscale-loadbalancer-zone: "ch-gva-2"
+    service.beta.kubernetes.io/exoscale-loadbalancer-name: "shorashim"
+spec:
+  type: LoadBalancer
+  selector:
+    app.kubernetes.io/name: shorashim
+  ports:
+    - port: 80
+      targetPort: 4000
+      protocol: TCP
+      name: http