feat(temporal): run maintenance directly in Temporal - #2005

Summary

Run Kometa and Buildkite maintenance entirely inside Temporal activities. The four existing schedule IDs and workflow names are preserved, but they now target a dedicated maintenance queue handled by one serial worker.

What changed

• Added direct Bun.spawn activities with Temporal heartbeats, cancellation termination, secret redaction, retry propagation, and success/failure metrics.
• Added the persistent temporal-maintenance-worker Deployment in buildkite, pinned to liskov, with Recreate strategy and one concurrent activity.
• Mounted the existing Bun cache/control, UV cache, and Trivy DB PVCs directly into the worker.
• Moved Kometa configuration and OnePassword references into the Buildkite-owned chart; media policy allows only this worker to reach Plex, and Temporal policy allows only its gRPC connection.
• Extended the existing Temporal worker image with pinned UV, Trivy, and Kometa runtimes and expanded the image smoke test.
• Removed maintenance Kubernetes Job builders, polling, image environment injection, Job RBAC, and media-owned Kometa resources. The unrelated Temporal namespace-init Job remains.
• Updated Temporal and cache lifecycle documentation and archived the dated implementation plan.

Verification

• Focused Temporal and homelab typecheck: passed.
• Maintenance activity, worker-role, schedule, Buildkite synthesis, and network-policy tests: passed.
• Changed-file ESLint, Prettier, pre-commit safety checks, and git diff --check: passed.
• Temporal image build and CLI smoke test: passed for Bun, UV, Trivy, and Kometa.
• Full Temporal suite: 500 passed; 3 existing integration tests require a local Temporal server at 127.0.0.1:7233 and fail when that server is unavailable.

Post-deploy acceptance

After ArgoCD sync, run each workflow once and verify the maintenance pod is Ready, Kometa updates Plex, cache/Trivy storage behavior is correct, metrics and stale-run alerting are present, and no maintenance Kubernetes Jobs are created.