fix: rewrite Tekton integration tests for X-Service routing

FIXES:
- Remove stale files: k8s/argocd-apps/, k8s/tekton/base/, overlays/
  (Tekton infra is in homelab repo, not here)
- Fix step.resources → step.computeResources (Tekton v1 API)
- Fix Task: use curl sidecar pattern instead of distroless image
  (distroless has no shell/curl/go)
- Fix routing: use X-Service + X-Resource headers, not path-based
- Extract test script to scripts/integration-test.sh (ConfigMap mount)
- Install kubectl in CI runner (was missing)
- Prune README to essentials

TASK ARCHITECTURE:
  sidecar: gateway image (mounts config secret, runs on localhost)
  step: curlimages/curl (runs integration-test.sh from ConfigMap)

TEST COVERAGE:
  health, header validation, memory, s3, sqs, workflow, iam

k8s/tekton/scripts/integration-test.sh

@@ -0,0 +1,115 @@
+#!/bin/sh
+set -e
+
+# Integration test runner for API gateway.
+# Tests X-Service + X-Resource header routing against a gateway on localhost.
+#
+# Required env:
+#   GW           — gateway base URL (e.g. http://localhost:8080)
+#   RESULTS_DIR  — directory to write Tekton results
+
+PASS=0; FAIL=0; TOTAL=0
+
+assert() {
+  NAME="$1"; EXPECT="$2"
+  shift 2
+  # remaining args are the full curl flags
+  TOTAL=$((TOTAL + 1))
+  CODE=$(curl -s -o /dev/null -w '%{http_code}' "$@" 2>/dev/null || echo "000")
+
+  if [ "$CODE" = "$EXPECT" ]; then
+    echo "  ✓ ${NAME} (${CODE})"
+    PASS=$((PASS + 1))
+  else
+    echo "  ✗ ${NAME} — expected ${EXPECT}, got ${CODE}"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+# ── Wait for sidecar gateway to be fully ready ──
+echo "⏳ Waiting for gateway sidecar..."
+READY=false
+for i in $(seq 1 60); do
+  CODE=$(curl -s -o /dev/null -w '%{http_code}' "${GW}/healthz" 2>/dev/null || echo "000")
+  if [ "$CODE" = "200" ]; then
+    sleep 1
+    C2=$(curl -s -o /dev/null -w '%{http_code}' "${GW}/healthz" 2>/dev/null || echo "000")
+    C3=$(curl -s -o /dev/null -w '%{http_code}' "${GW}/healthz" 2>/dev/null || echo "000")
+    if [ "$C2" = "200" ] && [ "$C3" = "200" ]; then
+      READY=true
+      echo "✓ Gateway ready (stable after 3 checks)"
+      break
+    fi
+  fi
+  sleep 2
+done
+
+if [ "$READY" = "false" ]; then
+  echo "✗ Gateway never became ready"
+  echo "fail" > "${RESULTS_DIR}/result"
+  echo "0/0 gateway timeout" > "${RESULTS_DIR}/summary"
+  exit 1
+fi
+
+echo ""
+echo "═══ Integration Tests ═══"
+echo ""
+
+# ── Health (path-based, no headers) ──
+echo "▸ Health"
+assert "GET /healthz" 200 \
+  -X GET "${GW}/healthz"
+assert "GET /readyz" 200 \
+  -X GET "${GW}/readyz"
+
+# ── Routing: missing headers → 400 ──
+echo "▸ Header validation"
+assert "no X-Service → 400" 400 \
+  -X GET "${GW}/"
+assert "X-Service without X-Resource → 400" 400 \
+  -X GET -H "X-Service: memory" "${GW}/"
+assert "unknown service → 404" 404 \
+  -X GET -H "X-Service: nonexistent" -H "X-Resource: foo" "${GW}/"
+
+# ── Memory service (POST, no auth) ──
+echo "▸ Memory service"
+assert "memory/query (POST)" 200 \
+  -X POST -H "X-Service: memory" -H "X-Resource: query" \
+  -H "Content-Type: application/json" -d '{"query":"test"}' "${GW}/"
+assert "memory/ingest (POST)" 200 \
+  -X POST -H "X-Service: memory" -H "X-Resource: ingest" \
+  -H "Content-Type: application/json" \
+  -d '{"content":"integration test","metadata":{"source":"tekton"}}' "${GW}/"
+
+# ── S3 service (GET, no auth → MinIO 403) ──
+echo "▸ S3 service"
+assert "s3/list-objects (GET → 403)" 403 \
+  -X GET -H "X-Service: s3" -H "X-Resource: list-objects" "${GW}/"
+
+# ── SQS service (GET, auth required → 401) ──
+echo "▸ SQS service"
+assert "sqs/list-queues (GET → 401)" 401 \
+  -X GET -H "X-Service: sqs" -H "X-Resource: list-queues" "${GW}/"
+
+# ── Workflow service (gRPC, GET) ──
+echo "▸ Workflow service"
+assert "workflow/list (GET → upstream err)" 502 \
+  -X GET -H "X-Service: workflow" -H "X-Resource: list" "${GW}/"
+
+# ── IAM service (GET, Authentik) ──
+echo "▸ IAM service"
+assert "iam/list-users (GET → Authentik redirect)" 302 \
+  -X GET -H "X-Service: iam" -H "X-Resource: list-users" "${GW}/"
+
+echo ""
+echo "═══ Results: ${PASS}/${TOTAL} passed, ${FAIL} failed ═══"
+
+# Write Tekton results
+if [ "$FAIL" -eq 0 ]; then
+  echo "pass" > "${RESULTS_DIR}/result"
+else
+  echo "fail" > "${RESULTS_DIR}/result"
+fi
+echo "${PASS}/${TOTAL} passed, ${FAIL} failed" > "${RESULTS_DIR}/summary"
+
+[ "$FAIL" -eq 0 ]