fix(k8s): correct paths, DB env var, and service selector

- Replace --data-dir flag with SORTIE_DB_PATH env var and update
  configmap db_path to match /home/sortie/data/.sortie.db
- Move workspace root under /home/sortie/data/workspaces so both
  SQLite and workspaces share the single PVC mount
- Mount WORKFLOW.md ConfigMap as directory /home/sortie/config instead
  of a single-file subPath mount (avoids inode replacement issues)
- Add app.kubernetes.io/component selector to Service to tighten pod
  matching
- Mark sortie-secrets secretRef optional: false to fail fast on missing
  credentials

Author: serghei-dev

examples/k8s/configmap.yaml

@@ -29,8 +29,10 @@ data:
     polling:
       interval_ms: 45000
 
+    db_path: /home/sortie/data/.sortie.db
+
     workspace:
-      root: /home/sortie/workspaces
+      root: /home/sortie/data/workspaces
 
     agent:
       kind: claude-code

examples/k8s/deployment.yaml

@@ -43,16 +43,18 @@ spec:
             - "0.0.0.0"
             - "--log-format"
             - "json"
-            - "--data-dir"
-            - "/home/sortie/data"
-            - "/home/sortie/WORKFLOW.md"
+            - "/home/sortie/config/WORKFLOW.md"
+          env:
+            - name: SORTIE_DB_PATH
+              value: /home/sortie/data/.sortie.db
           ports:
             - name: http
               containerPort: 7678
               protocol: TCP
           envFrom:
             - secretRef:
                 name: sortie-secrets
+                optional: false
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
@@ -86,8 +88,7 @@ spec:
             - name: data
               mountPath: /home/sortie/data
             - name: workflow
-              mountPath: /home/sortie/WORKFLOW.md
-              subPath: WORKFLOW.md
+              mountPath: /home/sortie/config
               readOnly: true
             - name: tmp
               mountPath: /tmp

examples/k8s/service.yaml

@@ -11,6 +11,7 @@ spec:
   type: ClusterIP
   selector:
     app.kubernetes.io/name: sortie
+    app.kubernetes.io/component: orchestrator
   ports:
     - name: http
       port: 7678