feat(worldbuilder): pin k8s demo to fake backend

apps/worldbuilder/README.md

@@ -28,9 +28,12 @@ Source: `D:\git\FlowerCore\FlowerCore.WorldBuilder` (master)
    Memory: `feedback_rke2_image_import_per_node_scp`.
 3. **Bump image tag** in `worldbuilder.yaml` and git push.
    ArgoCD ApplicationSet picks up within ~3 minutes.
-4. **First production render** — open `https://worldbuilder.iamworkin.lan`,
+4. **First production render** — open
-   create World → Character → Storyboard → ExportJob, confirm artifact
+   `https://worldbuilder.iamworkin.lan/studio/c32e0000-0000-4000-8000-000000000004`
-   downloads. ComfyUI lives on BLUEJAY-WS at `http://10.0.56.20:8188`.
+   and confirm the Cyberpunk Blue Jay demo prompt loads with five seeded fake
+   generated images. This Sprint 32 visitor-safe profile uses
+   `ClientMode=fake`; switch the image-generation env vars back to ComfyUI only
+   for an operator-owned GPU render lane.
 
 ## Health probes
 
@@ -53,8 +56,13 @@ Source: `D:\git\FlowerCore\FlowerCore.WorldBuilder` (master)
 
 ## Image generation backend
 
-`FlowerCore:WorldBuilder:ImageGeneration:BaseUrl=http://10.0.56.20:8188` —
+Sprint 32 pins the Kubernetes profile to
-ComfyUI runs on BLUEJAY-WS Windows (R9700 / gfx1201 / ROCm 7.2.1). Pod reaches
+`FlowerCore:WorldBuilder:ImageGeneration:ClientMode=fake` with
-the workstation directly across the 10.0.56.0/24 VLAN (no Podman-style host-
+`BaseUrl=http://127.0.0.1:1`. That keeps the public/internal visitor demo
-filter issues — K8s pods route via Calico, which is L3-routed across the
+deterministic, avoids GPU exposure, and still exercises the studio/gallery
-VLAN).
+surface with persisted generated-image metadata.
+
+The previous ComfyUI backend target was `http://10.0.56.20:8188` on
+BLUEJAY-WS (R9700 / gfx1201 / ROCm 7.2.1). Re-enable it only in an
+operator-owned follow-up that also verifies workstation reachability and image
+import freshness.

apps/worldbuilder/worldbuilder.yaml

@@ -16,7 +16,11 @@ kind: Namespace
 metadata:
   name: fc-worldbuilder
   labels:
+    app.kubernetes.io/name: fc-worldbuilder
     app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    flowercore.io/tenant-id: system
+    flowercore.io/created-by: bluejay-infra
 ---
 # SQLite DB + generated image gallery + PDF/PNG exports.
 # Longhorn RWO — single replica with `Recreate` rollout strategy keeps it safe.
@@ -25,6 +29,13 @@ kind: PersistentVolumeClaim
 metadata:
   name: worldbuilder-data
   namespace: fc-worldbuilder
+  labels:
+    app.kubernetes.io/name: worldbuilder-data
+    app.kubernetes.io/component: storage
+    app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    flowercore.io/tenant-id: system
+    flowercore.io/created-by: bluejay-infra
 spec:
   accessModes:
     - ReadWriteOnce
@@ -40,7 +51,13 @@ metadata:
   namespace: fc-worldbuilder
   labels:
     app.kubernetes.io/name: worldbuilder-web
+    app.kubernetes.io/component: web
     app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    flowercore.io/tenant-id: system
+    flowercore.io/created-by: bluejay-infra
+  annotations:
+    flowercore.io/traceability-standard: k8s-pod-ownership-and-traceability-standard
 spec:
   replicas: 1
   revisionHistoryLimit: 3
@@ -54,11 +71,16 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: worldbuilder-web
+        app.kubernetes.io/component: web
         app.kubernetes.io/part-of: flowercore
+        app.kubernetes.io/managed-by: argocd
+        flowercore.io/tenant-id: system
+        flowercore.io/created-by: bluejay-infra
       annotations:
         prometheus.io/scrape: "true"
         prometheus.io/port: "8080"
         prometheus.io/path: "/metrics/prometheus"
+        flowercore.io/audit-trace-id: "worldbuilder-runtime-demo"
     spec:
       securityContext:
         fsGroup: 1654
@@ -92,11 +114,14 @@ spec:
               value: "/data/gallery"
             - name: FlowerCore__WorldBuilder__Export__RootPath
               value: "/data/exports"
-            # ComfyUI on BLUEJAY-WS (R9700 / gfx1201 / ROCm 7.2.1).
+            # Visitor-safe Sprint 32 profile: fake backend keeps public demo
+            # rendering deterministic and avoids exposing BLUEJAY-WS GPU.
             - name: FlowerCore__WorldBuilder__ImageGeneration__BaseUrl
-              value: "http://10.0.56.20:8188"
+              value: "http://127.0.0.1:1"
             - name: FlowerCore__WorldBuilder__ImageGeneration__ClientMode
-              value: "comfyui"
+              value: "fake"
+            - name: FlowerCore__WorldBuilder__ImageGeneration__BackendId
+              value: "fake"
           resources:
             # Cluster CPU-request budget runs hot (99% on all 3 nodes at deploy
             # time) while actual CPU usage is well below capacity. Idle Blazor
@@ -165,7 +190,11 @@ metadata:
   namespace: fc-worldbuilder
   labels:
     app.kubernetes.io/name: worldbuilder-web
+    app.kubernetes.io/component: web
     app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    flowercore.io/tenant-id: system
+    flowercore.io/created-by: bluejay-infra
 spec:
   type: ClusterIP
   selector:
@@ -180,6 +209,13 @@ kind: Certificate
 metadata:
   name: worldbuilder-web-tls
   namespace: fc-worldbuilder
+  labels:
+    app.kubernetes.io/name: worldbuilder-web-tls
+    app.kubernetes.io/component: ingress
+    app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    flowercore.io/tenant-id: system
+    flowercore.io/created-by: bluejay-infra
 spec:
   secretName: worldbuilder-web-tls
   issuerRef:
@@ -200,6 +236,13 @@ kind: IngressRoute
 metadata:
   name: worldbuilder-web
   namespace: fc-worldbuilder
+  labels:
+    app.kubernetes.io/name: worldbuilder-web
+    app.kubernetes.io/component: ingress
+    app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    flowercore.io/tenant-id: system
+    flowercore.io/created-by: bluejay-infra
 spec:
   entryPoints:
     - websecure