[CodeBuildder]

Closes #98

Replaces #99, which GitHub automatically closed when its stacked base PR #97 merged and deleted its branch.

What changed

• adds guarded make demo-cluster and read-only make demo-cluster-dry-run
• requires exact context confirmation before mutation
• validates API, nodes, Cilium, Falco, Kyverno, and Argus readiness
• creates and cleans only the isolated argus-demo namespace
• runs bounded, non-root workloads using a pinned image
• collects real pod, Falco, Argus, Kyverno, and Cilium evidence
• adds safety regression tests
• documents the orbstack versus argus context distinction and real three-node k3s topology
• documents safe existing-cluster reuse, fresh setup constraints, cleanup, UI access, and troubleshooting
• removes contradictory setup paths and identifies unfinished targets honestly

Verification

• live read-only preflight passed against argus
• make test-cluster-demo passed
• shell syntax validation passed
• focused agent tests passed
• UI production build passed
• git diff --check passed

Next phase

Integrate the service port-forward and React console into the same make demo-cluster lifecycle.