feat(ql3): establish 3.0 incubation baseline

deploy/kubernetes/ql3-cluster/components/cluster-ai/README.md

@@ -0,0 +1,26 @@
+# Optional Cluster AI component
+
+This component replaces only the Cluster Control image with the explicit
+`runtime-ai` target. The default Cluster deployment and image remain AI-free.
+
+Before applying it:
+
+1. Replace the example Project, provider URL, model and policy revision in
+   `provider-authority-configmap.yaml`; keep `authority.json` canonical,
+   one-line JSON with one trailing newline.
+2. Bind the same Project/provider to a canonical SecretRef through the
+   append-only model-provider credential catalog.
+3. Project each provider authorization value under the lowercase SHA-256 of
+   its canonical SecretRef. Use `provider-secrets.example.yaml` only as a
+   shape reference and provision the real Secret through a Secret manager.
+4. Build and publish the Docker `runtime-ai` target, then pin its independent
+   digest in a private overlay based on `private-overlay.example.yaml`.
+
+The component mounts ConfigMap and Secret volumes read-only with mode `0440`,
+does not mount a ServiceAccount token, and grants no Kubernetes API access.
+It remains live-output-only by default. Compose the separate
+`../cluster-ai-prompt-output` component only when encrypted durable Prompt
+output and its externally provisioned keyring are required.
+Each replica adds a separate, bounded PostgreSQL runtime pool of four
+connections by default; tune `QL3_CLUSTER_AI_DATABASE_MAX_CONNECTIONS` and
+`QL3_CLUSTER_AI_MAX_CONCURRENT` together for the cluster's resource budget.