Minimal lab platform services (secrets, DNS/ingress, storage) and the first workload deploy. Exit criterion: eve-skill-farm runs in the lab cluster.