feat: define service-catalog workload contract for homelab validation

[clubanderson]

Summary

Defines the shared workload contract that every service-catalog lane under #51 must satisfy, closing #66. This is a documentation/contract-definition change — no workflows or test code.

Adds docs/service-catalog-contract.md covering nine areas:

1. K8s-native assumption — raw manifests only, no VMs, no Helm; VM-backed validation (epic: homelab cluster substrate and fleet-client model #54) is explicitly not a blocker
2. Deployment — namespace isolation, manifest application, readiness evidence, synthetic secrets created before Deployment
3. Persistence — PVC lifecycle, restart survival via sentinel file write/read, storage dependency on local-path (RWO), skip with feat: surface shared-storage and RWX blocker for homelab validation #62 reference for RWX
4. Reachability — cluster DNS resolution, endpoints evidence, HTTP response capture; layers feat: define first HTTPS service-exposure lane for homelab workloads #58 (HTTPS) and feat: define auth-gating lane for exposed homelab service UIs #61 (auth) as additive
5. Upgrade/redeploy — image tag change + config change evidence for lanes claiming durability; explicit gap statement otherwise
6. Teardown — onExit namespace deletion within 180s, idempotent cleanup, no cluster-scoped leaks
7. Cross-epic dependencies — explicit table linking epic: homelab storage and role-template validation #52 (storage), epic: homelab access, TLS, and service security #53 (access/TLS), epic: homelab cluster substrate and fleet-client model #54 (substrate/fleet-client) with status
8. Shared test infrastructure — documents kube.py symbols and run-incluster-tests env var contract
9. Lane compliance checklist — checkbox list for new lane PRs

Also adds a cross-reference from homelab-contracts.md to the new contract doc.

Links

• Closes feat: define service-catalog workload contract for homelab validation #66
• Child of epic: homelab service-catalog workload validation #51
• Consumed by feat: define representative media-service workload lane for homelab validation #59 (media lane), feat: define first non-media homelab workload lane #64 (non-media lane), feat: define deferred non-core homelab service follow-up for Home Assistant-class workloads #69 (HA-class deferred)
• Depends on epic: homelab storage and role-template validation #52 (storage), epic: homelab access, TLS, and service security #53 (access/TLS); epic: homelab cluster substrate and fleet-client model #54 (VM) is not a blocker

Test plan

• Documentation only — no runtime changes
• All nine contract sections are present and internally consistent
• Cross-epic dependency table references correct issues and statuses
• Lane compliance checklist covers all contract sections
• homelab-contracts.md cross-references the new doc

[hanthor]

LGTM — workload contract definition docs.

[hanthor]

Service-catalog lane addition. Merge after foundational #202. LGTM.

[hanthor]

Approved via org-wide review.

[hanthor]

Approved via org-wide review.

[hanthor]

Review: Approved ✅

Part of the structured service-catalog project build-up. Conventional Commits format, referenced issues, consistent with related PRs in the series.