svcforge: reference implementation

Complete working build of the system learn-python/ teaches.
164 tests, mypy --strict clean, domain coverage 99%.

deploy/chart/templates/pdb.yaml

@@ -0,0 +1,24 @@
+{{- if .Values.podDisruptionBudget.enabled }}
+{{/*
+Off by default, and not in the module-8 spec — included because it is cheap to have and
+expensive to retrofit.
+
+Only the api gets one. The worker does not need it: killing a worker mid-provision is
+already safe (chaos experiment 1 — the lease expires, the task returns to queued, and
+`helm upgrade --install` is a no-op on re-claim), so blocking a drain to protect it buys
+nothing. The reconciler must not get one: it is replicas: 1, and minAvailable: 1 on a
+single-replica Deployment blocks node drains forever.
+*/}}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "svcforge.fullname" . }}-api
+  labels:
+    {{- include "svcforge.labels" . | nindent 4 }}
+    app.kubernetes.io/component: api
+spec:
+  minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
+  selector:
+    matchLabels:
+      {{- include "svcforge.selectorLabels" (dict "ctx" $ "component" "api") | nindent 6 }}
+{{- end }}