feat(ql3): compose cluster copilot diagnosis

deploy/kubernetes/ql3-cluster/components/cluster-ai-copilot/README.md

@@ -0,0 +1,25 @@
+# Optional Cluster Copilot component
+
+Compose this component only with `../cluster-ai`. It enables the caller-driven
+failure-diagnosis capability inside the existing Cluster AI process; it does
+not add an HTTP route, queue, watcher, timer, PostgreSQL pool, provider, or
+Model Gateway.
+
+Before production use:
+
+1. Replace the example provider, model and egress policy revision in
+   `copilot-configmap.yaml`. Keep `config.json` canonical, one-line JSON with
+   one trailing newline.
+2. Provision these three Secrets out of band, each containing a canonical
+   `keyring.json`: `ql3-cluster-ai-copilot-invocation-keyring`,
+   `ql3-cluster-ai-copilot-result-keyring`, and
+   `ql3-cluster-ai-copilot-output-keyring`.
+3. Keep old decryptable keys during rotation. Invocation, Tool result and
+   Copilot output keys are independent authorities and must never reuse
+   material.
+4. Keep Worker ingress and its bounded S3 log-range reader enabled. Startup
+   fails closed if the log capability, canonical config, any keyring, or the
+   shared successful-completion sink is unavailable.
+
+All projections are read-only mode `0440`. The component adds no Kubernetes
+API permission and does not change the default AI-free deployment.

deploy/kubernetes/ql3-cluster/components/cluster-ai-copilot/copilot-configmap.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ql3-cluster-ai-copilot
+data:
+  config.json: |
+    {"schema":"qinglong/cluster-copilot-failure-diagnosis-config@v1","provider":"provider-primary","model":"model-diagnosis","modelBoundary":"external","responseLanguage":"zh-CN","maxOutputTokens":512,"executionTimeoutMs":60000,"egressPolicy":{"schema":"qinglong/copilot-model-egress-policy@v1","revision":"replace-before-production","potentiallySensitiveDataBoundaries":["external"],"maxInputBytes":65536,"maxOutputTokens":1024}}

deploy/kubernetes/ql3-cluster/components/cluster-ai-copilot/deployment-patch.yaml

@@ -0,0 +1,62 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ql3-cluster-control
+spec:
+  template:
+    spec:
+      containers:
+        - name: cluster-control
+          env:
+            - name: QL3_CLUSTER_AI_COPILOT_ENABLED
+              value: "true"
+            - name: QL3_CLUSTER_AI_COPILOT_CONFIG_FILE
+              value: /var/run/qinglong3/ai/copilot-config/config.json
+            - name: QL3_CLUSTER_AI_COPILOT_INVOCATION_KEYRING_ROOT
+              value: /var/run/secrets/qinglong3/ai/copilot-invocation-keyring
+            - name: QL3_CLUSTER_AI_COPILOT_RESULT_KEYRING_ROOT
+              value: /var/run/secrets/qinglong3/ai/copilot-result-keyring
+            - name: QL3_CLUSTER_AI_COPILOT_OUTPUT_KEYRING_ROOT
+              value: /var/run/secrets/qinglong3/ai/copilot-output-keyring
+          volumeMounts:
+            - name: cluster-ai-copilot-config
+              mountPath: /var/run/qinglong3/ai/copilot-config
+              readOnly: true
+            - name: cluster-ai-copilot-invocation-keyring
+              mountPath: /var/run/secrets/qinglong3/ai/copilot-invocation-keyring
+              readOnly: true
+            - name: cluster-ai-copilot-result-keyring
+              mountPath: /var/run/secrets/qinglong3/ai/copilot-result-keyring
+              readOnly: true
+            - name: cluster-ai-copilot-output-keyring
+              mountPath: /var/run/secrets/qinglong3/ai/copilot-output-keyring
+              readOnly: true
+      volumes:
+        - name: cluster-ai-copilot-config
+          configMap:
+            name: ql3-cluster-ai-copilot
+            defaultMode: 288
+            items:
+              - key: config.json
+                path: config.json
+        - name: cluster-ai-copilot-invocation-keyring
+          secret:
+            secretName: ql3-cluster-ai-copilot-invocation-keyring
+            defaultMode: 288
+            items:
+              - key: keyring.json
+                path: keyring.json
+        - name: cluster-ai-copilot-result-keyring
+          secret:
+            secretName: ql3-cluster-ai-copilot-result-keyring
+            defaultMode: 288
+            items:
+              - key: keyring.json
+                path: keyring.json
+        - name: cluster-ai-copilot-output-keyring
+          secret:
+            secretName: ql3-cluster-ai-copilot-output-keyring
+            defaultMode: 288
+            items:
+              - key: keyring.json
+                path: keyring.json

deploy/kubernetes/ql3-cluster/components/cluster-ai-copilot/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+resources:
+  - copilot-configmap.yaml
+
+patches:
+  - path: deployment-patch.yaml

deploy/kubernetes/ql3-cluster/overlays/cluster-ai-copilot-example/kustomization.yaml

@@ -0,0 +1,16 @@
+# Example only. Copy into a private overlay, replace all example model policy
+# values and provision the three keyring Secrets out of band.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../base
+
+components:
+  - ../../components/cluster-ai
+  - ../../components/cluster-ai-copilot
+
+images:
+  - name: qinglong3-cluster-control-ai
+    newName: registry.example.com/qinglong/qinglong3-cluster-control-ai
+    digest: sha256:0000000000000000000000000000000000000000000000000000000000000000