Phase 10: prove guarded live k3s resilience

[CodeBuildder]

Closes #116

What changed

• adds make demo-platform-live-dry-run as a read-only preflight for the complete k3s security, chaos, agent, and SOG stack
• turns make demo-platform-live into a guarded, observed proof instead of deterministic cluster-backed seeding
• requires exact-context confirmation plus the explicit phrase INJECT LIVE FAULT
• creates a two-replica HTTP target only in sentinel-live-demo, continuously measures reachability, and limits Chaos Mesh to one disposable replica
• requires Argus/Falco evidence before fault injection, verifies the real PodChaos object, and proves a new Ready replacement plus two Ready replicas
• publishes only verified observed + live_chaos evidence into Sentinel and emits an auditable JSON/Markdown scorecard
• preserves the portable cluster-free judge demo and updates the Build Week/video plan

Why

The portable simulator proves integration safely, but judges also need a truthful live demonstration. Previously the k3s command still seeded deterministic evidence and could not substantiate actual detection, chaos execution, availability, or recovery claims. This phase adds that proof while preserving a narrow blast radius and human-in-the-loop authorization.

Safety boundary

• dry-run creates nothing
• existing namespaces are never reused
• unsafe/system namespaces are rejected
• fault duration is restricted to 5–30 seconds
• exactly one of two demo replicas is targeted
• cleanup deletes only the namespace created by this run
• no fault runs without two explicit operator confirmations

Validation

• bash scripts/tests/test-demo-platform-live.sh
• bash scripts/tests/test-demo-platform.sh
• bash -n for all changed shell scripts
• git diff --check
• make demo-platform-live-dry-run against context argus: all Cilium, Falco, Kyverno, Argus, Chaos Mesh, Phoenix, and Sentinel checks passed; no resources were changed
• existing deterministic judge artifact successfully re-rendered with the updated report renderer

Stack

This PR is intentionally based on agent/cluster-free-platform-demo and should merge after the cluster-free demo PR. It leaves the default make demo-platform behavior unchanged.