Initial cursor-devbox: image, deploy manifests, and Flux SHA automation.

Owns Dockerfile/CI and node1 workload YAML; ImagePolicy elects run_number-sha tags and ImageUpdateAutomation commits them into deploy/.

deploy/010-namespace-secrets.yaml

@@ -0,0 +1,61 @@
+# Namespace, DCR pull secret, SSH allowlist, Service.
+# Reconciled by Flux Kustomization cursor-devbox (path ./deploy) on node1-k3s.
+
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cursor-devbox
+  labels:
+    name: cursor-devbox
+  annotations:
+    linkerd.io/inject: disabled
+
+---
+# Replicate federated DCR RO credentials for kubelet imagePullSecrets.
+apiVersion: secret-adapter.trinitysan.by/v1
+kind: SecretAdapter
+metadata:
+  name: dcr-registry-auth-ro
+  namespace: cursor-devbox
+spec:
+  name: dcr-registry-auth-ro
+  namespace: cursor-devbox
+  type: kubernetes.io/dockerconfigjson
+  waitForSources: true
+  syncInterval: 60
+  stringData:
+    .dockerconfigjson: ${federated-secrets.dcr-registry-auth-ro.".dockerconfigjson"}
+
+---
+# Hardcoded allowlist: laptop SSH public keys (not secrets).
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cursor-devbox-authorized-keys
+  namespace: cursor-devbox
+data:
+  authorized_keys: |
+    ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDbyPCd5RhlTZYCIgmrSGR6ugnwI513vzHf0qvUP3pGf8mYVd68G6CLu9OXJxFv+LKo2eT8H3ToxLpuG0iiIWz+4rJrNXTJInU2lqrcMsHhLoo1XCs7OAARYiIp7Pl4XKcLdbiXwdL2XUsHImv7cjmaD6jGJ3yR+q9t6jORQEB/h6nUc0MMkNKLIrUyJSlZtWRp22ymGnEqiwKl9doukii6QBhY1k+i9oW09ln6gbFTol9KoONkJ74b2iKw5abZwyjjXuXaE1b98/nmI30MYs8VMJC/w9pEZbmVEflb1k4+C1IE5llwmievjNWpWlZt38uzvGTLbiC9mMIewwFm4UsT5ASLpYKBdFrCaK4JIOTCdJt+SMInkzz0rArCNPMBwZIjBgCFSM33nJsX4gbf/l/rnVtLjXr86rF5s9SOSVyQmjPJoBigqyGw45H2CrB7iTqqWGCpPTnXbzzspiIQGYXLW5+5/4wARCPO0KXYcPgg4Vzh5z+dMcFKJvc8XhocZCc= aaa@LAPTOP-08PG1IL5
+    ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDK+dk9MtPgRZr7638SASpbJK7z+XkmBesXRlozTFqvT0X6gKk+75kyqNR2W+ZXDwiiWuXS2t9Dbdk9Xpuj2uWaUE0D+n3NOFEQV27Zd1ZTMeLlf3ukSLhb7un0pFHXQXvPn2Iwhh5zCyTDvIWU1rHUgBmakmxoRZ6zwJdsZX/yZHurts//7Dvb2xKKYAq4MFMAB+s6Ch80q6kCnHcByJVFyVLfOUVcNzHGUQbbj4pft2QYiTVxqTBZdvdWQvdBRkKjV2oK/mRUfGsdwmk+ldT65hdcFjbG3oG4hD3g2+AJC+/vN/xqlCeht/TU/Ei4GMF3UB3ank7z1rsGbU1T5lDoFWBWMg+tgw7ZdbYD+HIi/kuQU3FKM2xekB2fgpzuu5GQynjflygBmuQQp5/HAJDoxrkt+Yn79QX6aan8xXcHnt600Bm7SWfnsCl6BpcaD/8f2Lr8CcFCN5pcG020gvLSVdok71dB27NQ/2HOax1i0WQTZVjDrL6kMwRb37njr/k= svv@LAPTOP-08PG1IL5
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: cursor-devbox
+  namespace: cursor-devbox
+  annotations:
+    service.kubernetes.io/topology-mode: Auto
+spec:
+  selector:
+    app: cursor-devbox
+  ports:
+    - name: ssh
+      port: 22
+      targetPort: ssh
+      protocol: TCP
+    - name: http
+      port: 8080
+      targetPort: http
+      protocol: TCP