deploy engram-server to neuron-prod: dharma storage backend

- Add engram-server Deployment, Service, PVC to neuron-prod
- engram-server is the graph memory substrate for DHARMA registry
- Add allow-engram-ingress NetworkPolicy (ingress from neuron-prod)
- ENGRAM_URL in Vault updated to http://engram-server.neuron-prod.svc.cluster.local:8742
- Image: registry.neuralplatform.ai/neuron-technologies/engram-server:latest
  compiled from foundation/engram dist/engram.c + el_runtime

servers/legion/k8s/neuron-technologies/prod/engram-deployment.yaml

@@ -0,0 +1,103 @@
+---
+# engram-server — graph memory substrate for DHARMA registry.
+# Provides the HTTP API that dharma's EngramDB client talks to.
+# Routes: GET/POST /nodes, POST /edges, GET /nodes/list, POST /search, etc.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: engram-server
+  namespace: neuron-prod
+  labels:
+    app: engram-server
+    env: prod
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: engram-server
+  template:
+    metadata:
+      labels:
+        app: engram-server
+        env: prod
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1001
+        fsGroup: 1001
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: engram-server
+          image: registry.neuralplatform.ai/neuron-technologies/engram-server:latest
+          imagePullPolicy: Always
+          ports:
+            - name: http
+              containerPort: 8742
+          env:
+            - name: ENGRAM_BIND
+              value: ":8742"
+            - name: ENGRAM_DATA_DIR
+              value: "/data"
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: false
+            runAsNonRoot: true
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 8742
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 8742
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            failureThreshold: 3
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: engram-data
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: engram-data
+  namespace: neuron-prod
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: engram-server
+  namespace: neuron-prod
+  labels:
+    app: engram-server
+spec:
+  selector:
+    app: engram-server
+  ports:
+    - name: http
+      port: 8742
+      targetPort: 8742
+  type: ClusterIP

servers/legion/k8s/neuron-technologies/prod/kustomization.yaml

@@ -13,6 +13,7 @@ resources:
   - license-ingressroute.yaml
   - rest-ingressroute.yaml
   - mcp-ingressroute.yaml
+  - engram-deployment.yaml
   - backup-cronjob.yaml
   - runpod-inference.yaml
   - runpod-lb-configmap.yaml

servers/legion/k8s/neuron-technologies/prod/network-policy.yaml

@@ -99,6 +99,24 @@ spec:
             matchLabels:
               kubernetes.io/metadata.name: kube-system
 ---
+# ── engram-server: accept from dharma and neuron-prod namespace ──────────────
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-engram-ingress
+  namespace: neuron-prod
+spec:
+  podSelector:
+    matchLabels:
+      app: engram-server
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: neuron-prod
+---
 # ── Egress: all prod pods may reach platform (postgres/redis), vault,
 #            monitoring (alloy OTLP), kube-dns, and the internet (external APIs) ─
 apiVersion: networking.k8s.io/v1