ops(ax): worker pool, digest-pinned runner image, CLI from the deployed checkout

Substrate installs no WorkerPool (resume failed: no free workers) and rejects
images not pinned by digest; ax's default runner image on gcr.io needs
credentials, so the smoke task runs our runner (repo-facts over a one-file
workspace). A release ax CLI skewed from the server (UpdateTask unimplemented).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

ops/ax/workerpool.yaml.tmpl

@@ -0,0 +1,23 @@
+# Warm gVisor workers for ax tasks on this host (Agent Substrate WorkerPool). ax's per-task ActorTemplates
+# set no workerSelector, so every pool of the matching sandbox class is eligible. Two workers of 1 CPU /
+# 1.5 GiB fit the 7 GB host beside the control planes; an actor occupies a whole worker.
+apiVersion: ate.dev/v1alpha1
+kind: WorkerPool
+metadata:
+  name: ousast-pool
+  namespace: ax-system
+  labels:
+    workload: ousast
+spec:
+  replicas: 2
+  workerImage: ko://github.com/agent-substrate/substrate/cmd/ateom-gvisor
+  template:
+    nodeSelector:
+      ate.dev/substrate-version: "${SUBSTRATE_VERSION}"
+    resources:
+      limits:
+        cpu: "1"
+        memory: 1536Mi
+      requests:
+        cpu: 250m
+        memory: 1536Mi