Add container orchestration plugins

Author: marcofortina

README.md

@@ -283,6 +283,8 @@ flow:          if/then/else, switch/case/default, retry/do, for/in/do, block, se
 filesystem:    fs.*
 data:          data.archive.*, data.compression.*, data.download.*, data.transfer.*, data.backup.*, data.restore.*
 database:      database.<engine>.check, database.<engine>.query
+containers:    container.image.*, container.container.*, container.compose.*
+orchestration: kubernetes.*, helm.*
 identity:      identity.user.*, identity.group.*
 network:       network.connectivity.*, network.dns.*, network.firewall.*, network.http.*, network.link.*, network.route.*
 os/packages:   os.*, os.package.*

docs/plugins/container-orchestration.md

@@ -0,0 +1,82 @@
+<!--
+Copyright (C) 2026 Marco Fortina
+SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+# Container and orchestration plugins
+
+Automax provides explicit plugins for container hosts and controller-side cluster operations.
+
+## Docker and Podman
+
+Container plugins run on the selected remote target through the step SSH session. Use `backend: docker` or `backend: podman`.
+
+```yaml
+- id: pull_image
+  use: container.image.pull
+  with:
+    backend: podman
+    image: registry.example/app:1.2.3
+```
+
+Container and Compose operations include deterministic manual command rendering for handovers and recovery:
+
+```yaml
+- id: compose_check
+  use: container.compose.config.check
+  with:
+    backend: docker
+    project_dir: /srv/app
+    file: compose.yaml
+
+- id: compose_up
+  use: container.compose.up
+  with:
+    backend: docker
+    project_dir: /srv/app
+    file: compose.yaml
+    detach: true
+    compose_services:
+      - web
+```
+
+Destructive operations such as image removal, container removal, container stop and Compose down require `confirm: true`.
+
+## Kubernetes
+
+Kubernetes plugins are controller-side in this release. They call `kubectl` from the Automax controller and use the controller's configured authentication.
+
+```yaml
+- id: apply_manifest
+  use: kubernetes.apply
+  with:
+    context: prod
+    namespace: apps
+    manifest: deploy.yaml
+    server_side: true
+```
+
+Supported Kubernetes operations include context checks, namespace checks, apply, delete, rollout status, resource get and logs. `kubernetes.delete` requires `confirm: true`.
+
+## Helm
+
+Helm plugins are controller-side and call `helm` from the Automax controller.
+
+```yaml
+- id: deploy_chart
+  use: helm.upgrade
+  with:
+    release: web
+    chart: ./chart
+    namespace: apps
+    install: true
+    atomic: true
+    wait: true
+    helm_timeout: 5m
+    values_files:
+      - values-prod.yaml
+    set:
+      - image.tag=1.2.3
+```
+
+Use `helm.template` and `helm.lint` for preflight rendering and validation. `helm.rollback` and `helm.uninstall` require `confirm: true`.