feat(phase-1.2): temporal SDK client, worker mgmt, k8s deployments

- internal/temporal/client.go: robust client with retry + TLS + health check
- internal/temporal/worker.go: worker creation, registration, lifecycle
- internal/temporal/context.go: timeout helpers
- k8s/worker-deployment.yaml: 2-10 replica HPA, health probes, security context
- k8s/workflow-runner-deployment.yaml: singleton runner with probes
- k8s/kustomization.yaml: updated resource list, removed missing ref

Tests: 11 pass (client_test.go + worker_test.go)
Build: go build ./... clean
Kustomize: dry-run validated

k8s/kustomization.yaml

@@ -4,19 +4,19 @@ kind: Kustomization
 namespace: poimen
 
 resources:
-  - poimen-application.yaml
+  - worker-deployment.yaml
+  - workflow-runner-deployment.yaml
+  - workflows-deployment.yaml
+  - git-commit.yaml
+
+# SOPS-encrypted configmap applied separately via KSOPS plugin:
+#   - configmap.enc.yaml
 
 commonLabels:
   app.kubernetes.io/name: poimen
   app.kubernetes.io/component: worker
 
 images:
-  - name: forgejo.riotpiao.com/rock/poimen-memory
-    newName: forgejo.riotpiao.com/rock/poimen-memory
-    newTag: latest
   - name: forgejo.riotpiao.com/rock/poimen-workflows
-    newName: forgejo.riotpiao.com/rock/poimen-workflows
-    newTag: latest
-  - name: forgejo.riotpiao.com/rock/poimen-frontend
-    newName: forgejo.riotpiao.com/rock/poimen-frontend
+    newName: forgejo.riotpiao.com/riotpiao-poimen/poimen-workflows
     newTag: latest