Draft: carry Fineas foundation onto upstream Centaur

[fineas-bot]

Summary

• publish Centaur images under ghcr.io/tiplink/centaur and add the Fineas infra promotion PR workflow
• carry forward Fineas overlay image support for API-RS and agent-k8s sandboxes
• preserve the refreshed /home/agent/.api_key lookup for long-lived tool calls

Not included

• legacy Python services/api changes
• legacy services/slackbot changes
• --fast/model shortcut plumbing beyond what upstream Slackbot v2 already has
• a full API-RS port of the old signed sandbox-token TTL refresh behavior

Tests

• git diff --check
• helm lint contrib/chart
• helm template centaur contrib/chart --namespace centaur-sandbox
• helm template centaur contrib/chart --namespace centaur-sandbox --set overlay.image.repository=ghcr.io/tiplink/fineas-centaur-overlay --set overlay.image.tag=sha-test --set overlay.image.sourcePath=/overlay
• pnpm --filter slackbotv2 test
• pnpm --filter slackbotv2 check:types
• PYTHONPATH=/Users/fin-sa/centaur-upstream-rebuild uv run --project centaur_sdk --with pytest --with pytest-asyncio pytest centaur_sdk/tests/test_tool_sdk.py
• docker run --rm --user "$(id -u):$(id -g)" -v "$PWD":/workspace -w /workspace/services/api-rs -e CARGO_HOME=/tmp/cargo -e CARGO_TARGET_DIR=/tmp/target rust:1.91-bookworm cargo test --locked -p centaur-sandbox-agent-k8s -p centaur-api-server overlay_image
• docker run --rm -v "$PWD":/workspace -w /workspace/services/api-rs rust:1.91-bookworm sh -lc '/usr/local/cargo/bin/rustup component add rustfmt >/tmp/rustfmt-install.log && /usr/local/cargo/bin/cargo fmt --all -- --check'

Review note

This targets the upstream-base rebuild branch so the PR shows only the Fineas carry-forward work. It is not meant to merge directly into the old TipLink main without the baseline upstream cutover step.