Build Week: add one-command deterministic platform demo - #111

Why

Judges need one paved path through Argus, Phoenix, Sentinel, and the Sentinel Operations Graph without manually coordinating five port-forwards and three local consoles. The path also needs to prove that the unified incident is real, correlated data rather than disconnected dashboard fixtures.

Closes #110.

What changed

• adds make demo-platform-dry-run for a non-mutating dependency and cluster-service preflight
• adds make demo-platform to start or reuse the SOG, Phoenix services, all three APIs, and dashboards
• publishes a seeded Argus replay finding and Phoenix simulator recovery outcome for one shared entity
• verifies Sentinel exposes the exact cross-agent correlation and provenance before declaring readiness
• prints the canonical judge URLs: Argus :5173, Phoenix :5174, and Sentinel :5175
• tracks process ownership so Ctrl-C stops only processes started by the command
• documents the complete platform path and Build Week phase record
• adds a focused orchestration guard test

Safety and provenance

The default deterministic path does not inject live Chaos Mesh faults or create Kubernetes resources. Evidence is explicitly labeled replayed and simulator, uses seed 42, and is verified through the Sentinel API. The dry run starts no processes, opens no port-forwards, and publishes no findings. Existing healthy services are reused.

Verification

• make test-platform-demo
• make demo-platform-dry-run against the argus k3s context
• DEMO_PLATFORM_EXIT_AFTER_READY=true make demo-platform
  • verified correlation judge-demo-20260718T225146Z-36889
  • sources: Argus + Phoenix
  • provenance: replayed + simulator
• make test-agent — 91 passed
• make test-ui — production build passed
• git diff --check