Build Week: add cluster-free and live platform demo paths

[CodeBuildder]

Why

The prior safe platform demo still depended on deployed k3s services, which made it unsuitable as the default judge path. Safe fault injection and cluster-free portability are separate requirements. Judges need a polished one-command experience on a clean laptop, while maintainers still need the real-cluster integration proof.

This PR is intentionally stacked on #113. Merge #113 first, then retarget this PR to main.

Closes #114.

What changed

• makes make demo-platform and make demo-platform-local fully cluster-free
• adds make demo-platform-live for the existing real-k3s integration path
• adds separate non-mutating local and live preflights
• installs missing Python and npm dependencies on first local launch
• starts a disposable Redis-backed real SOG and all local product services
• replaces only known project listeners and kubectl port-forwards on reserved ports
• seeds an explicitly synthetic three-node, nine-namespace, 18-entity topology with 16 relationships
• populates Argus with deterministic threats and Sentinel with three cross-agent lifecycles
• runs a bounded dynamic feed so counters, freshness, risk, and timelines visibly update
• labels every synthetic entity and evidence payload; keeps replay/simulator provenance explicit
• generates the same auditable JSON and Markdown proof artifacts
• updates Make help, README quick paths, Build Week record, and orchestration guards

Safety

Local mode makes zero Kubernetes API calls and creates no Chaos Mesh resources. It uses one uniquely named disposable Redis container and removes it on exit. It never terminates an unrelated port listener. It does not claim live Falco latency, live chaos, or measured production availability.

End-to-end verification

DEMO_PLATFORM_EXIT_AFTER_READY=true make demo-platform completed with:

• Kubernetes API calls: 0
• 18 SOG entities, 16 relationships, 9 namespaces
• 6 initial findings and 3 correlated incidents
• recovery verified in simulator
• provenance: replayed + simulator, seed 42
• Argus :5173, Phoenix :5174, Sentinel :5175
• generated JSON and Markdown evidence

Dynamic verification used a 2-second test interval and confirmed the SOG finding count increased while Phoenix served 12 synthetic nodes and 14 fixture edges through its UI proxy.

Regression checks

• make test-platform-demo
• make test-agent — 91 passed
• make test-ui — production build passed
• make demo-platform-dry-run
• full cluster-free end-to-end run
• git diff --check