fix: rewrite Tekton integration tests for X-Service routing

FIXES:
- Remove stale files: k8s/argocd-apps/, k8s/tekton/base/, overlays/
  (Tekton infra is in homelab repo, not here)
- Fix step.resources → step.computeResources (Tekton v1 API)
- Fix Task: use curl sidecar pattern instead of distroless image
  (distroless has no shell/curl/go)
- Fix routing: use X-Service + X-Resource headers, not path-based
- Extract test script to scripts/integration-test.sh (ConfigMap mount)
- Install kubectl in CI runner (was missing)
- Prune README to essentials

TASK ARCHITECTURE:
  sidecar: gateway image (mounts config secret, runs on localhost)
  step: curlimages/curl (runs integration-test.sh from ConfigMap)

TEST COVERAGE:
  health, header validation, memory, s3, sqs, workflow, iam

k8s/tekton/task-integration-test.yaml

@@ -7,79 +7,69 @@ metadata:
     app: api-gateway
     component: testing
 spec:
-  description: Run integration tests for API gateway
+  description: >
+    Spin up a gateway pod from the given image as a sidecar,
+    run curl-based integration tests, report pass/fail.
   params:
   - name: image
     type: string
-    description: Container image to test (including tag)
-  - name: timeout
+    description: "Container image to test (repo:tag)"
+  - name: gateway-port
     type: string
-    default: "5m"
-    description: Test timeout
+    default: "8080"
   results:
   - name: result
-    description: Test result (pass/fail)
     type: string
-  - name: message
-    description: Test summary message
+  - name: summary
     type: string
+
+  sidecars:
+  - name: gateway
+    image: $(params.image)
+    env:
+    - name: LISTEN_ADDR
+      value: "0.0.0.0:$(params.gateway-port)"
+    - name: CONFIG_PATH
+      value: /etc/gateway/config.yaml
+    - name: LOG_LEVEL
+      value: info
+    - name: AUTH_CLIENT_SECRET
+      valueFrom:
+        secretKeyRef:
+          name: api-gw-client-secret
+          key: client-secret
+          optional: true
+    volumeMounts:
+    - name: gateway-config
+      mountPath: /etc/gateway
+      readOnly: true
+
   steps:
   - name: run-tests
-    image: $(params.image)
-    securityContext:
-      runAsNonRoot: true
-      runAsUser: 65532
-      allowPrivilegeEscalation: false
+    image: curlimages/curl:8.13.0
     env:
-    - name: GATEWAY_URL
-      value: "http://api-gateway:8080"
-    - name: CI
-      value: "true"
-    script: |
-      #!/bin/sh
-      set -e
-      
-      echo "🧪 Starting integration tests..."
-      echo "Image: $(params.image)"
-      echo "Gateway: $GATEWAY_URL"
-      echo ""
-      
-      # Wait for gateway to be ready
-      echo "Waiting for gateway service..."
-      for i in $(seq 1 30); do
-        if curl -s $GATEWAY_URL/healthz > /dev/null 2>&1; then
-          echo "✓ Gateway is ready"
-          break
-        fi
-        echo "Attempt $i/30: Waiting for gateway..."
-        sleep 2
-      done
-      
-      # Run integration tests
-      echo "Running integration tests..."
-      if go test -v -tags=integration -timeout=$(params.timeout) ./internal/integration/...; then
-        echo "pass" | tee $(results.result.path)
-        echo "✓ All integration tests passed" | tee $(results.message.path)
-        exit 0
-      else
-        echo "fail" | tee $(results.result.path)
-        echo "✗ Some integration tests failed" | tee $(results.message.path)
-        exit 1
-      fi
+    - name: GW
+      value: "http://localhost:$(params.gateway-port)"
+    - name: RESULTS_DIR
+      value: /tekton/results
+    command: ["sh", "/scripts/integration-test.sh"]
     volumeMounts:
-    - name: tmp
-      mountPath: /tmp
-    - name: home
-      mountPath: /home/nonroot
-    resources:
+    - name: test-script
+      mountPath: /scripts
+      readOnly: true
+    computeResources:
       requests:
-        cpu: 250m
-        memory: 512Mi
+        cpu: 100m
+        memory: 64Mi
       limits:
-        cpu: 500m
-        memory: 1Gi
+        cpu: 200m
+        memory: 128Mi
+
   volumes:
-  - name: tmp
-    emptyDir: {}
-  - name: home
-    emptyDir: {}
+  - name: gateway-config
+    secret:
+      secretName: api-gateway-config
+  - name: test-script
+    configMap:
+      name: integration-test-script
+      defaultMode: 0755