feat(openviking): pilot deployment to fastpass (wave 8)

Platform Knowledge Infrastructure pilot - context database for large
file trees, shared skills, and long-term logs to reduce agent token
consumption. Pilot scope: two corpora (hermes/ skills library,
personal/homelab/), two consumer profiles (Wong, Shuri) for before/after
token comparison.

- namespace.yaml: openviking namespace, sync-wave 8 (after Harbor wave 7)
- externalsecret.yaml: credentials from 1Password via onepassword-connect
  ClusterSecretStore (Wong, t_32766900)
- values.yaml: Helm overrides - px-fa-direct-access storage (30Gi),
  embedding (nomic-embed-text-v1.5) + VLM (Llama-3.1-8B) via astro-orbiter
  router (:8002), internal-only ingress
- application.yaml: multi-source ArgoCD Application, Harbor pattern
  (Peter Parker, t_eefdcc17 + reconciled in t_3e54efa8)

Prerequisites verified complete before this commit:
- nomic-embed-text-v1.5-Q4_K_M live on astro-orbiter router (War Machine,
  t_34b96e83, commit ad70b34)
- All 3 1Password items provisioned (root/embedding/vlm api keys)
- Storage class corrected to px-fa-direct-access after live PV audit
  showed pure-block/pure-file have zero provisioned volumes (t_77b3ff79)
- Dry-run validated against live cluster prior to commit

Constraint: vault (~/friday) remains canonical source of truth; OpenViking
index is a derived cache, rebuilt from vault source files.

Honcho/lincoln explicitly out of scope for this work.

cluster/platform/openviking/application.yaml

@@ -0,0 +1,79 @@
+# ============================================================================
+# ArgoCD Application: OpenViking
+# Wave: 8 (after Harbor at Wave 7)
+# Deployment method: GitOps (Gitea -> ArgoCD)
+# ============================================================================
+#
+# Multi-source: Helm chart from upstream VolcEngine + local values + manifests from repo
+# Follows Harbor's pattern exactly (multi-source Application with local value overrides).
+#
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: openviking
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "8"
+    description: |
+      OpenViking Platform Knowledge Infrastructure pilot deployment
+      Pilot scope: Two corpora (hermes/ skills library, personal/homelab/)
+      Two consumer profiles (Wong, Shuri) for before/after token comparison.
+      
+      CRITICAL CONSTRAINT: Vault (~/friday) is the canonical source of truth.
+      OpenViking's index is a derived cache, rebuilt from vault source files.
+      If index and vault ever diverge, vault wins and re-index runs.
+      See inbox/ryan/2026-08-13-openviking-pilot-deployment-plan.md
+spec:
+  project: default
+
+  sources:
+    # Source 1: Helm chart from upstream VolcEngine/OpenViking repository
+    - repoURL: https://github.com/volcengine/openviking.git
+      chart: deploy/helm/openviking
+      targetRevision: main
+      helm:
+        valueFiles:
+          # Local values override upstream defaults
+          - $values/cluster/platform/openviking/values.yaml
+
+    # Source 2: Gitea homelab repo — values + ExternalSecret + namespace + ingress manifests
+    - repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
+      targetRevision: main
+      path: cluster/platform/openviking
+      ref: values
+      directory:
+        # Exclude the Application manifest itself (already in argocd)
+        exclude: "application.yaml"
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: openviking
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+      # Important: do not prune ExternalSecrets on ArgoCD uninstall
+      # (credentials live in 1Password, re-sync on pod restart)
+      - PrunePropagationPolicy=background
+
+# ============================================================================
+# DEPLOYMENT GATE: DO NOT SYNC TO ARGOCD UNTIL
+# ============================================================================
+# 1. Wong's Phase 1 (t_32766900) is complete: ExternalSecret manifests exist in Gitea,
+#    1Password vault items (openviking-root-api-key, openviking-embedding-api-key, openviking-vlm-api-key)
+#    are provisioned and synced to the cluster.
+#
+# 2. Model staging (separate task): nomic-embed-text-v1.5-Q4_K_M.gguf has been pulled into
+#    /opt/models/ on astro-orbiter and the router preset INI section appended + router restarted.
+#    Verify: POST http://10.1.71.130:8002/v1/embeddings with model="nomic-embed-text-v1.5"
+#    returns a 768-dim float vector.
+#
+# 3. Smoke test plan (below) documented and ready to execute post-sync.
+#
+# Contact: Peter Parker (Phase 2 owner) — check for blocker updates via kanban comment
+# or by monitoring Wong's task (t_32766900) for completion.
+# ============================================================================