feat: add IaC layer with shared var/t1 and var/t3 data paths

Ansible provisions the k3d cluster and Flux controllers; Terraform
modules deploy the simulated fleet and ground warehouse. Compose and
k3d share var/t1 (live lake) and var/t3 (warehouse). The prototype
gains a live mode fed by the explorer read-only SQL API.

infra/gitops/README.md

@@ -0,0 +1,52 @@
+# GitOps — ground segment (Flux)
+
+Flux reconciles **long-lived ground configuration** from this repository. It does
+not run on drones and does not replace the fleet release manifest — those are
+different lifecycles by design ([11 — CI/CD](../../docs/11-cicd-delivery.md)).
+
+## Boundary: Terraform vs Flux vs fleet manifest
+
+| Layer | Tool | Owns |
+| --- | --- | --- |
+| Cluster + first boot | **Terraform** ([`../terraform/`](../terraform/)) | Namespaces, PVCs, Deployments, CronJobs, NodePorts — the shape of the simulation |
+| Ongoing ground config | **Flux** (this directory) | Policy labels, dashboard bundles, offload knobs — things that change without reprovisioning PVCs |
+| Drones | **Fleet release manifest** | Compose bundle digests, model weights, peer registry — atomic, dock-only delivery |
+
+Drones are **outside GitOps**: there is no reconciler in flight. A dock applies
+the pinned manifest once; mid-mission drift is impossible because the update
+endpoint does not exist in the radio profile.
+
+## Layout
+
+```
+infra/gitops/
+  flux/           Flux GitRepository + Kustomization CRs (install into flux-system)
+  ground/         Kustomize overlay reconciled into the ground namespace
+```
+
+## Bootstrap on the k3d simulation cluster
+
+`infra/ansible/sim-cluster.yml` installs Flux controllers and applies the CRs
+below. After the first `git push`, Flux polls `origin` and reconciles
+`infra/gitops/ground/` into the `ground` namespace.
+
+```bash
+# Manual bootstrap (if you skipped Ansible):
+flux install --namespace=flux-system
+kubectl apply -k infra/gitops/flux
+```
+
+To reconcile immediately without waiting for the poll interval:
+
+```bash
+flux reconcile source git swarm-house -n flux-system
+flux reconcile kustomization ground-segment -n flux-system
+```
+
+## What Flux manages here (example)
+
+The [`ground/`](ground/) overlay currently carries a **GitOps-managed ConfigMap**
+that tags the warehouse segment with fleet policy metadata. In production this
+pattern extends to Grafana dashboard bundles, Prometheus rule files, and
+offload-schedule ConfigMaps — all versioned in git, all auditable, none of
+them requiring a `terraform apply` to tweak a label.

infra/gitops/flux/gitrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: swarm-house
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: https://git.produktor.io/eSlider/swarm-house.git
+  ref:
+    branch: main

infra/gitops/flux/kustomization-ground.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: ground-segment
+  namespace: flux-system
+spec:
+  interval: 2m
+  sourceRef:
+    kind: GitRepository
+    name: swarm-house
+  path: ./infra/gitops/ground
+  prune: true
+  wait: true
+  timeout: 3m

infra/gitops/flux/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - gitrepository.yaml
+  - kustomization-ground.yaml

infra/gitops/ground/configmap-fleet-policy.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ground-fleet-policy
+  namespace: ground
+  labels:
+    app.kubernetes.io/part-of: swarm-ground
+    app.kubernetes.io/managed-by: flux
+data:
+  offload_schedule: "*/2 * * * *"
+  retention_policy: "keep-all-flights"
+  explorer_mode: "read-only-sql"

infra/gitops/ground/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: ground
+resources:
+  - namespace.yaml
+  - configmap-fleet-policy.yaml

infra/gitops/ground/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ground
+  labels:
+    app.kubernetes.io/part-of: swarm-ground