engine: worker Deployment from the image (S3 queue with leases, dispatcher --executor queue, engine-image workflow, scoped RustFS policy); merge main

Implemented with Codex. Cluster deploy pending the k3s kubeconfig and the scoped account.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

ops/k8s/engine/secret.example.yaml

@@ -0,0 +1,9 @@
+# Reference only; excluded from kustomization. Create using the README command.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ousast-engine-s3
+  namespace: ousast-engine
+type: Opaque
+stringData: {}
+# Required keys: S3_ENDPOINT, S3_BUCKET, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY