[CodeBuildder]

Closes #101

Outcome

make demo-cluster now owns the complete real-cluster demo lifecycle: preflight, in-cluster agent connection, React console, real workload injection, evidence collection, observation, and cleanup. No second terminal is required.

What changed

• installs locked UI dependencies only when missing
• rejects occupied local HTTP ports 8000 and 5173
• supervises an IPv4 port-forward from the in-cluster Argus service
• verifies direct agent health and UI-proxied /api/health
• starts and supervises the React/Vite console
• prints the console URL before cluster mutation
• injects real workloads only after both UI paths are healthy
• keeps the console active until Ctrl-C
• prints child-process logs on startup or runtime failure
• refuses to reuse or delete a pre-existing namespace
• tracks namespace ownership for scoped cleanup
• stops the UI and port-forward and deletes only the run-owned namespace
• updates tests and documentation

Live verification

Executed against the real argus context after Cilium recovered to 3/3 Ready:

• three k3s nodes Ready
• Cilium 3/3, Falco 3/3, Kyverno, and Argus readiness passed
• direct http://127.0.0.1:8000/health returned 200
• proxied http://127.0.0.1:5173/api/health returned 200
• all five bounded threat pods became Ready across all three nodes
• Argus received and accepted real Falco webhook events
• the React console remained available through evidence collection
• Ctrl-C stopped ports 8000 and 5173
• argus-demo entered Terminating through scoped cleanup

Additional environment finding

The deployed Argus secret currently produces Anthropic 401 authentication errors. The agent degraded safely to HUMAN_REQUIRED and completed its audit pipeline. Rotating that cluster secret is separate from this lifecycle PR and should be tracked before the final judged AI demo. Falco log collection also observed one transient worker2 kubelet EOF immediately after OrbStack resume; Argus webhook evidence still proved real event delivery.

Automated verification

• cluster-demo guard tests passed
• shell syntax validation passed
• UI production build passed
• focused agent suite: 8 passed
• git diff --check passed