Factory M5 — The seams become real

[artyomsv]

Goal: two implementations of each seam, because a seam with one arm is a claim.

Part of the software factory epic. Blocked on M4.

Today spire-harness has exactly one arm (spire-harness-codex) and spire-runtime has exactly
one (spire-runtime-docker). Both are shaped as ports and neither has been proven to be one.

Delivers

• spire-harness-pi — MIT, provider-agnostic through the existing LLM registry, and the
  first arm that can carry steer via its bidirectional session mode. M1 shipped steer as
  refused-where-undeclared precisely because no arm declared it.
• spire-runtime-k8s — one Pod per run, no Docker socket, real NetworkPolicy, TTL
  cleanup, landing into the Helm and kustomize artefacts that already exist under deploy/.

Two debts this milestone is the natural home for

• The shared workspace volume has no disk bound
  (techdebt/spire-runtime-docker/2-3-…, High, surviving since M1). The only portable Docker
  enforcement — a size-bounded tmpfs — is dropped when the last container using it stops, which
  would wipe the clone between init exiting and the agent starting. Kubernetes has
  sizeLimit on an emptyDir, so the k8s arm can close on its own arm what the Docker arm
  cannot.
• The agent container on the default bridge reaches host-published ports
  (techdebt/spire-runtime-docker/4-3-…). A real NetworkPolicy is the answer the Docker arm
  does not have.

Exit criterion

• The same work item runs to a pull request under both harnesses and both runtimes, with
  no change to domain code and no new entry in the spire-arch allowlist that is not a
  composition root.

That last clause is the real test. The allowlist is the measure of whether the seam held: a second
arm that needs core edits proves the port was a shape, not a boundary.

FRs: FR-F15. Docs: docs/factory/ROADMAP.md § M5,
docs/factory/AGENT-IMAGE-CONTRACT.md, docs/factory/RUN-TOPOLOGY.md.