fix(api): use trebuchet-* names + dedicated worker SA in Job spec

The app was renamed hightower → trebuchet but the worker Job spec still
referenced hightower-workspaces PVC, hightower-temporal Service, and used
the default ServiceAccount.  These break at runtime (the hightower-*
resources don't exist) and block tightening the Istio ambient
AuthorizationPolicies in farhoodlabs/infra.

- PVC claimName: hightower-workspaces → trebuchet-workspaces
- TEMPORAL_ADDRESS env: hightower-temporal:7233 → trebuchet-temporal:7233
- serviceAccountName: default → trebuchet-worker
- config.ts default: hightower-temporal:7233 → trebuchet-temporal:7233

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/api/src/config.ts

@@ -30,7 +30,7 @@ export function loadConfig(): Config {
   return {
     port: Number(process.env.PORT) || 3000,
     mcpPort: Number(process.env.MCP_PORT) || 3100,
-    temporalAddress: process.env.TEMPORAL_ADDRESS || 'hightower-temporal:7233',
+    temporalAddress: process.env.TEMPORAL_ADDRESS || 'trebuchet-temporal:7233',
     apiKey,
     k8sNamespace: process.env.K8S_NAMESPACE || 'hightower',
     workerImage,

apps/api/src/services/job-builder.ts

@@ -43,7 +43,7 @@ export function buildJobSpec(params: JobParams): k8s.V1Job {
 
   // 2. Build volumes and mounts
   const volumes: k8s.V1Volume[] = [
-    { name: 'workspaces', persistentVolumeClaim: { claimName: 'hightower-workspaces' } },
+    { name: 'workspaces', persistentVolumeClaim: { claimName: 'trebuchet-workspaces' } },
     { name: 'shm', emptyDir: { medium: 'Memory', sizeLimit: '2Gi' } },
   ];
 
@@ -96,7 +96,7 @@ export function buildJobSpec(params: JobParams): k8s.V1Job {
   }
 
   // 4. Env vars
-  const env: k8s.V1EnvVar[] = [{ name: 'TEMPORAL_ADDRESS', value: 'hightower-temporal:7233' }];
+  const env: k8s.V1EnvVar[] = [{ name: 'TEMPORAL_ADDRESS', value: 'trebuchet-temporal:7233' }];
 
   // 5. Construct the Job
   return {
@@ -123,7 +123,7 @@ export function buildJobSpec(params: JobParams): k8s.V1Job {
         },
         spec: {
           restartPolicy: 'Never',
-          serviceAccountName: 'default',
+          serviceAccountName: 'trebuchet-worker',
           securityContext: {
             seccompProfile: { type: 'Unconfined' },
             // Claude Code refuses --allow-dangerously-skip-permissions as root.