feat(workflows): wire TaskUnit/Orchestrator activities, add k8s deploy manifests

Implements real activity-calling logic in OrchestratorWorkflow and
TaskUnitWorkflow (previously stubs), adds GitDiffActivity, and expands
PlanningActivity's I/O to carry repo path and prior task results.

Adds k8s/ deployment manifests (worker Deployment, orchestrator Job,
Kustomize base) for the poimen-workflows Temporal worker, using a
dedicated Kubernetes namespace `poimen` and Temporal namespace
`poimen-harness` rather than sharing the Temporal server's own
`temporal`/`production` namespaces.

action/skills.go

@@ -17,15 +17,20 @@ import (
 type PrepareSkillsInput struct {
 	Skills        []statemachine.SkillRef
 	StreamTimeout time.Duration
+	Provider      string // pi provider name (e.g. "homelab-reasoning"); required, pi has no usable default provider
 }
 
 // PrepareSkillsActivity prepares skills for use via pi command.
 func PrepareSkillsActivity(ctx context.Context, in PrepareSkillsInput) error {
+	if in.Provider == "" {
+		return fmt.Errorf("PrepareSkillsInput.Provider must be set (pi has no usable default provider)")
+	}
+
 	for _, skill := range in.Skills {
 		activity.RecordHeartbeat(ctx, skill.Name)
 
-		// Run: pi clone-or-fetch <skill-url> --stream-timeout=<duration>
-		cmd := exec.CommandContext(ctx, "pi", "clone-or-fetch", skill.URL, fmt.Sprintf("--stream-timeout=%s", in.StreamTimeout.String()))
+		// Run: pi clone-or-fetch <skill-url> --provider=<provider> --stream-timeout=<duration>
+		cmd := exec.CommandContext(ctx, "pi", "clone-or-fetch", skill.URL, "--provider="+in.Provider, fmt.Sprintf("--stream-timeout=%s", in.StreamTimeout.String()))
 		if err := cmd.Run(); err != nil {
 			// Classify error
 			classifiedErr := ClassifyPiErr(err, skill.Name)