feat(deployment): add CPU mock Compose E2E

[Staaaaaaaaar]

Summary

• add a multi-stage CPU mock runtime image with an installed RoboHarness overlay and no source bind mount
• run env, agent, and experiment as three independent Compose services on a private ROS 2 network
• add a deadline-based black-box harness that validates ROS graph discovery, three automatic Episodes, stable containers, and the committed result tree
• add an independent CI job with result and service-log artifact upload
• document the development-image, builder-stage, and runtime-image boundaries

Image boundary

The development container remains the supported source-mounted environment for editing, incremental Colcon builds, lint, and tests. The runtime Dockerfile builds a clean merged install tree in a temporary builder stage and copies only that overlay into the final image.

The pinned upstream ros:humble-ros-base image itself includes some general ROS build utilities. The runtime does not add repository source, Ruff, Colcon build directories, or development caches, and no runtime service performs a build during startup. Removing upstream Colcon packages with APT would also remove required ROS runtime packages, including rclpy, so PR 12 preserves the base image package graph.

Validation

• make dev-check — 16 packages, 207 tests, 0 failures
• make mock-e2e — three services discovered, three Episodes committed as expected, container IDs/PIDs stable, restart count 0
• result schema and exact artifact layout validated independently
• Compose stack removed successfully after validation
• git diff --check origin/main...HEAD

Scope

CPU mock deployment only. GPU, Isaac Sim, and GUI runtime images remain out of scope for PR 12.