feat: add K8s API server, orchestrator abstraction, and CI pipeline

- Add apps/api/ — Hono REST API server for managing pentest scans via K8s Jobs
  - POST/GET /api/scans, GET /api/scans/:id, cancel, report endpoints
  - Bearer token auth, Temporal client integration, K8s Job builder
  - Dockerfile, Kustomize manifests (Deployment, Service, RBAC)
- Add CLI orchestrator abstraction (docker.ts → Orchestrator interface)
  - DockerOrchestrator and K8sOrchestrator implementations
  - Backend detection via SHANNON_BACKEND env var or --backend flag
- Add CI workflow: type-check + lint on PR, build+push both images on main
- Switch all workflows to self-hosted runners (runners-farhoodliquor)
- Add shannon-api image build to release and release-beta workflows
- Add root infra/kustomization.yaml as Flux entry point
- Export PipelineProgress from @shannon/worker/pipeline

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/cli/src/commands/workspaces.ts

@@ -2,30 +2,19 @@
  * `shannon workspaces` command — list all workspaces.
  */
 
-import { execFileSync } from 'node:child_process';
-import os from 'node:os';
-import { getWorkerImage } from '../docker.js';
+import { getOrchestrator } from '../backend.js';
 import { getWorkspacesDir } from '../home.js';
 
-export function workspaces(version: string): void {
+export async function workspaces(version: string): Promise<void> {
+  const orchestrator = await getOrchestrator();
   const workspacesDir = getWorkspacesDir();
-  const image = getWorkerImage(version);
+  const image = orchestrator.getWorkerImage(version);
 
   try {
-    execFileSync(
-      'docker',
-      [
-        'run',
-        '--rm',
-        '-v',
-        `${workspacesDir}:/app/workspaces`,
-        '-e',
-        'WORKSPACES_DIR=/app/workspaces',
-        image,
-        'node',
-        'apps/worker/dist/temporal/workspaces.js',
-      ],
-      { stdio: 'inherit', ...(os.platform() === 'win32' && { env: { ...process.env, MSYS_NO_PATHCONV: '1' } }) },
+    orchestrator.runEphemeral(
+      image,
+      ['node', 'apps/worker/dist/temporal/workspaces.js'],
+      [`${workspacesDir}:/app/workspaces`],
     );
   } catch {
     console.error('ERROR: Failed to list workspaces. Is the Docker image available?');