feat(workflows): wire TaskUnit/Orchestrator activities, add k8s deploy manifests

Implements real activity-calling logic in OrchestratorWorkflow and
TaskUnitWorkflow (previously stubs), adds GitDiffActivity, and expands
PlanningActivity's I/O to carry repo path and prior task results.

Adds k8s/ deployment manifests (worker Deployment, orchestrator Job,
Kustomize base) for the poimen-workflows Temporal worker, using a
dedicated Kubernetes namespace `poimen` and Temporal namespace
`poimen-harness` rather than sharing the Temporal server's own
`temporal`/`production` namespaces.

action/git.go

@@ -190,3 +190,29 @@ func GitSquashMergeActivity(ctx context.Context, in GitSquashMergeInput) error {
 
 	return nil
 }
+
+// GitDiffInput is input to GitDiffActivity.
+type GitDiffInput struct {
+	WorktreePath string
+}
+
+// GitDiffOutput is output of GitDiffActivity.
+type GitDiffOutput struct {
+	Diff string
+}
+
+// GitDiffActivity gets git diff for a worktree.
+func GitDiffActivity(ctx context.Context, in GitDiffInput) (GitDiffOutput, error) {
+	out := GitDiffOutput{Diff: ""}
+
+	// Get diff from worktree against main branch
+	cmd := exec.CommandContext(ctx, "git", "-C", in.WorktreePath, "diff", "main")
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		// Diff can fail if branch doesn't exist, treat as no changes
+		return out, nil
+	}
+
+	out.Diff = string(output)
+	return out, nil
+}