feat(canary): bootstrap r001 namespace on sol

.gitea/workflows/deploy-trade-r001-canary.yaml

@@ -0,0 +1,63 @@
+name: deploy-trade-r001-canary
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - environments/sol/trade-r001-canary/**
+      - .gitea/workflows/deploy-trade-r001-canary.yaml
+  workflow_dispatch:
+
+jobs:
+  apply:
+    runs-on: k3s-deploy
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Materialize kubeconfig
+        env:
+          K3S_KUBECONFIG_B64: ${{ secrets.K3S_KUBECONFIG_B64 }}
+        run: |
+          test -n "$K3S_KUBECONFIG_B64"
+          printf '%s' "$K3S_KUBECONFIG_B64" | base64 -d >/tmp/kubeconfig
+          chmod 600 /tmp/kubeconfig
+
+      - name: Install kubectl
+        run: |
+          curl -fsSL -o /tmp/kubectl https://dl.k8s.io/release/v1.34.6/bin/linux/amd64/kubectl
+          install -m 0755 /tmp/kubectl /usr/local/bin/kubectl
+          kubectl version --client
+
+      - name: Apply canary namespace
+        env:
+          KUBECONFIG: /tmp/kubeconfig
+        run: |
+          kubectl apply -k environments/sol/trade-r001-canary
+          kubectl get ns trade-r001-canary --show-labels
+          kubectl -n trade-r001-canary get resourcequota,limitrange
+
+      - name: Verify canary namespace connectivity
+        env:
+          KUBECONFIG: /tmp/kubeconfig
+        run: |
+          kubectl -n trade-r001-canary delete pod canary-netcheck --ignore-not-found=true
+          kubectl -n trade-r001-canary run canary-netcheck \
+            --image=python:3.12-alpine \
+            --restart=Never \
+            --command -- sleep 600
+          kubectl -n trade-r001-canary wait --for=condition=Ready pod/canary-netcheck --timeout=180s
+          kubectl -n trade-r001-canary exec canary-netcheck -- python - <<'PY'
+          import socket
+
+          targets = [
+              ("postgres-host.trade-infra.svc.cluster.local", 5432),
+              ("redis-host.trade-infra.svc.cluster.local", 6379),
+          ]
+
+          for host, port in targets:
+              with socket.create_connection((host, port), timeout=5):
+                  print(f"OK {host}:{port}")
+          PY
+          kubectl -n trade-r001-canary delete pod canary-netcheck --wait=true