[#702] add Tilt dev loop (workstation dev-only) + prod-guard Tiltfile

https://projects.knownelement.com/issues/702

.crush/active-ticket

@@ -1 +1 @@
-#699
+#702

dev/README.md

@@ -0,0 +1,8 @@
+# dev/ — workstation development loop (Tilt)
+
+Workstation = dev-only (founder rule, 2026-09-05). Production delivery stays
+flux-only (gitops, clusters/pfv-k8s/). Tilt provides the fast iteration loop
+for k8s services under development before they graduate to git.
+
+- `tilt up` — start the dev loop (UI: http://localhost:10350)
+- Tiltfile targets local/dev contexts; prod namespaces are guarded.

dev/Tiltfile

@@ -0,0 +1,20 @@
+# Tiltfile — WORKSTATION DEV LOOP (dev-only rule: this machine never runs prod)
+#
+# Pairs with ADR-0001: flux remains the ONLY path to prod (git -> pfv-k8s).
+# Tilt gives a fast local iteration loop for k8s-deployed services BEFORE they
+# graduate to the flux-managed manifests in clusters/pfv-k8s/.
+#
+# Usage (on the workstation):
+#   tilt up                     # dev UI on http://localhost:10350
+#   tilt down
+#
+# By default this targets the LOCAL cluster context; point at pfv-k8s only
+# with an explicit dev namespace (tilt-dev), never against prod namespaces.
+
+# --- example dev service (uncomment + adapt per service) ---
+# yaml = k8s_yaml(['dev/mcpjungle-dev.yaml'])
+# k8s_resource('mcpjungle-dev', port_forwards=['18080:8080'])
+
+# Dev-namespace guard: refuse to run against prod manifests
+fail_if(cond=os.path.exists('clusters/pfv-k8s/flux-system'),
+        msg='This Tiltfile is for local dev only. Prod delivery = flux (do not mix).')