ops(ax): worker pool, digest-pinned runner image, CLI from the deployed checkout

Substrate installs no WorkerPool (resume failed: no free workers) and rejects
images not pinned by digest; ax's default runner image on gcr.io needs
credentials, so the smoke task runs our runner (repo-facts over a one-file
workspace). A release ax CLI skewed from the server (UpdateTask unimplemented).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

ops/ax/smoke-task.yaml.tmpl

@@ -0,0 +1,32 @@
+# Bring-up smoke test: our runner image runs the model-free repo-facts task over a files-only workspace.
+apiVersion: ax.io/v1alpha1
+kind: Task
+metadata:
+  name: ousast-smoke
+  atespace: default
+spec:
+  image: "${RUNNER_IMAGE}"   # digest-pinned (Substrate rejects tags); rendered by up.sh
+  command: ["repo-facts"]
+  env:
+    - name: OUSAST_OUTPUT_DIR
+      value: "/workspace/.ousast-out/smoke"
+  resources:
+    requests:
+      cpu: "100m"
+      memory: "256Mi"
+    limits:
+      cpu: "1"
+      memory: "1Gi"
+  workspaces:
+    - name: ousast-smoke-ws
+      path: "/workspace"
+---
+apiVersion: ax.io/v1alpha1
+kind: Workspace
+metadata:
+  name: ousast-smoke-ws
+  atespace: default
+spec:
+  files:
+    - path: "hello.py"
+      content: "def hello():\n    return greet()\n"