feat(workflows): wire TaskUnit/Orchestrator activities, add k8s deploy manifests

Implements real activity-calling logic in OrchestratorWorkflow and
TaskUnitWorkflow (previously stubs), adds GitDiffActivity, and expands
PlanningActivity's I/O to carry repo path and prior task results.

Adds k8s/ deployment manifests (worker Deployment, orchestrator Job,
Kustomize base) for the poimen-workflows Temporal worker, using a
dedicated Kubernetes namespace `poimen` and Temporal namespace
`poimen-harness` rather than sharing the Temporal server's own
`temporal`/`production` namespaces.

k8s/kustomization.yaml

@@ -0,0 +1,24 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: poimen
+
+resources:
+  - configmap.yaml
+  - worker-deployment.yaml
+  - orchestrator-job.yaml
+  # secret.yaml is auto-generated from secrets.env below
+
+commonLabels:
+  app.kubernetes.io/name: poimen
+  app.kubernetes.io/component: orchestrator
+
+secretGenerator:
+  - name: poimen-secrets
+    envs:
+      - secrets.env
+    behavior: merge
+
+configMapGenerator:
+  - name: poimen-config
+    behavior: merge