feat: full kubeclaw operator — CRDs, controllers, deploy manifests, Helm chart

- 7 CRDs (Agent, AgentConfig, AgentGroup, Channel, Provider, WorkflowTemplate, CompliancePolicy)
- 3 controllers (Agent, WorkflowTemplate, CompliancePolicy)
- Generated deepcopy methods (controller-gen v0.16.5)
- Dockerfile (multi-stage Go build)
- Nix build-image.nix (dockerTools.streamLayeredImage)
- Helm chart with RBAC, deployment, service account
- Deploy manifests (RBAC + controller deployment)
- Sample manifests for all 7 CRDs
- Quickstart script
- Successfully deployed to k3s on n97-mini:
  - Controller running and reconciling
  - All 7 CRDs registered
  - Agent CR creates Pod (ErrImagePull expected — no agent image yet)
  - Controller logs show reconciliation working

internal/controller/workflowtemplate_controller.go

@@ -0,0 +1,57 @@
+/*
+Copyright 2025 Scott Scoble. Licensed under the MIT License.
+*/
+
+package controller
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+
+	kubeclawv1alpha1 "github.com/sscoble/kubeclaw/api/v1alpha1"
+)
+
+// WorkflowTemplateReconciler reconciles WorkflowTemplate objects.
+type WorkflowTemplateReconciler struct {
+	client.Client
+	Scheme *runtime.Scheme
+}
+
+func (r *WorkflowTemplateReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
+	logger := log.FromContext(ctx)
+
+	wt := &kubeclawv1alpha1.WorkflowTemplate{}
+	if err := r.Get(ctx, req.NamespacedName, wt); err != nil {
+		return ctrl.Result{}, client.IgnoreNotFound(err)
+	}
+
+	logger.Info("validating workflow template", "name", wt.Name)
+
+	// Validate basic shape
+	valid := true
+	if len(wt.Spec.Steps) == 0 {
+		valid = false
+	}
+	if wt.Spec.AuditLevel == "" {
+		wt.Spec.AuditLevel = "standard"
+	}
+
+	wt.Status.Ready = valid
+	wt.Status.Validated = true
+
+	if err := r.Status().Update(ctx, wt); err != nil {
+		return ctrl.Result{}, err
+	}
+
+	return ctrl.Result{}, nil
+}
+
+func (r *WorkflowTemplateReconciler) SetupWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewControllerManagedBy(mgr).
+		For(&kubeclawv1alpha1.WorkflowTemplate{}).
+		Complete(r)
+}