feat: AI VM stack (WP-12) and Alloy telemetry on k8s, legacy and DB VMs (WP-15)

WP-12(실험 설계서 6장) vm/ai-env: apply.sh(시크릿 4종을 Secret Manager에서 파일로, 미등록이면
성능 저하 모드로 기동), compose(agent 8080·hitl 8081·rag-db pgvector 0.8.7-pg16), ai.env(Discord
서버 Selfheal Lab 1557424985793101824, approvals 1557425140302872698, escalation 1557425282363691048,
OPENAI_MODEL gpt-6.1-sol 후보), 프롬프트 3종, 러너북 11종(조치별·토폴로지·3층 절차).

WP-15(실험 설계서 4.1·4.3): apps/alloy.yaml(Alloy Helm 1.13.0 DaemonSet, 클러스터링으로 KSM·Argo CD·
cadvisor 스크랩 분산, demo 등 파드 로그 → Loki), apps/kube-state-metrics.yaml(Helm 8.6.0).
legacy-api compose에 Alloy 사이드카(up{job="legacy-api"}, 컨테이너 로그). DB VM은
vm/postgres-common/alloy.sh로 apt 설치 + prometheus.exporter.postgres(pg_replication_lag_seconds)
+ custom query pg_is_wal_replay_paused + PostgreSQL 로그.

vm/harness/apply.sh: 준비 대기 루프의 curl에 || true(러너 재기동 순간 curl 56으로 중단되던 문제,
2026-10-08 harness-sync 실측).

vm/ai-env/compose.yaml

@@ -0,0 +1,49 @@
+# AI VM (10.20.0.12), experiment design 6.1: agent 8080 (/diagnose for the harness), rag-db (pgvector, internal),
+# hitl 8081 (Discord gateway bot; /post and /escalate for the agent). Images: selfheal-lab-apps/ai (Cloud Build).
+services:
+  agent:
+    image: asia-northeast1-docker.pkg.dev/cms-d-414903/selfheal-public/ai-agent:${AI_TAG}
+    container_name: agent
+    restart: always
+    env_file: /opt/selfheal/ai.env
+    environment:
+      RAG_DSN: "postgres://ai:${RAG_DB_PASSWORD}@rag-db:5432/ai?sslmode=disable"
+      HITL_URL: http://hitl:8081
+      OPENAI_KEY_FILE: /run/secrets/openai-api-key
+      K8S_TOKEN_FILE: /run/secrets/k8s-token
+      K8S_CA_FILE: /run/secrets/k8s-ca.crt
+      PROMPT_DIR: /etc/ai/prompts
+      RUNBOOK_DIR: /etc/ai/runbooks
+    volumes:
+      - /opt/selfheal/ai/secrets:/run/secrets:ro
+      - ./prompts:/etc/ai/prompts:ro
+      - ./runbooks:/etc/ai/runbooks:ro
+    ports:
+      - "8080:8080"
+    depends_on: [rag-db]
+  hitl:
+    image: asia-northeast1-docker.pkg.dev/cms-d-414903/selfheal-public/ai-hitl:${AI_TAG}
+    container_name: hitl
+    restart: always
+    env_file: /opt/selfheal/ai.env
+    environment:
+      RAG_DSN: "postgres://ai:${RAG_DB_PASSWORD}@rag-db:5432/ai?sslmode=disable"
+      DISCORD_TOKEN_FILE: /run/secrets/discord-bot-token
+    volumes:
+      - /opt/selfheal/ai/secrets:/run/secrets:ro
+    ports:
+      - "8081:8081"
+    depends_on: [rag-db]
+  rag-db:
+    # pgvector 0.8.7 on PostgreSQL 16 (Docker Hub tag checked 2026-10-08); HNSW index up to 2000 dimensions (design 6.4)
+    image: pgvector/pgvector:0.8.7-pg16
+    container_name: rag-db
+    restart: always
+    environment:
+      POSTGRES_USER: ai
+      POSTGRES_PASSWORD: "${RAG_DB_PASSWORD}"
+      POSTGRES_DB: ai
+    volumes:
+      - rag-data:/var/lib/postgresql/data
+volumes:
+  rag-data: {}