feat(nci-11): add Kubernetes manifests for nowchess-analysis service (#381)

Add Argo Rollout (blueGreen), active/preview Services, and HPA for the
new analysis service (port 8087). Wire image pins into all three overlay
kustomizations and register the analysis Warehouse and freight entries in
all three Kargo Stages (staging -> eu-central-1-prod / htwg-1-prod).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Janis Eccarius <eccariusjanis@gmail.com>
Reviewed-on: #381

nowchess/base/nowchess-hpa.yaml

@@ -1,5 +1,27 @@
 apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler
+metadata:
+  name: nowchess-analysis
+  labels:
+    app.kubernetes.io/name: nowchess-analysis
+    app.kubernetes.io/part-of: nowchess
+spec:
+  scaleTargetRef:
+    apiVersion: argoproj.io/v1alpha1
+    kind: Rollout
+    name: nowchess-analysis
+  minReplicas: 1
+  maxReplicas: 3
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 90
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
 metadata:
   name: nowchess-account
 spec:

nowchess/base/nowchess-rollouts.yaml

@@ -755,6 +755,73 @@ spec:
 ---
 apiVersion: argoproj.io/v1alpha1
 kind: Rollout
+metadata:
+  name: nowchess-analysis
+  labels:
+    app: nowchess-analysis
+    app.kubernetes.io/name: nowchess-analysis
+    app.kubernetes.io/part-of: nowchess
+spec:
+  selector:
+    matchLabels:
+      app: nowchess-analysis
+  template:
+    metadata:
+      labels:
+        app: nowchess-analysis
+      annotations:
+        k8s.grafana.com/scrape: "true"
+        k8s.grafana.com/metrics_path: "/q/metrics"
+        k8s.grafana.com/metrics_portNumber: "8087"
+    spec:
+      imagePullSecrets:
+        - name: ghcr-pull-secret
+      containers:
+        - name: nowchess-analysis
+          image: ghcr.io/now-chess/now-chess-systems/analysis:latest
+          imagePullPolicy: Always
+          envFrom:
+            - configMapRef:
+                name: nowchess-env-config
+          env:
+            - name: INTERNAL_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: ncs-internal-secret
+                  key: INTERNAL_SECRET
+          ports:
+            - containerPort: 8087
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /q/health/live
+              port: 8087
+            initialDelaySeconds: 0
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /q/health/ready
+              port: 8087
+            initialDelaySeconds: 0
+            periodSeconds: 5
+          resources:
+            requests:
+              cpu: "5m"
+              memory: "96Mi"
+            limits:
+              cpu: "500m"
+              memory: "256Mi"
+  rollbackWindow:
+    revisions: 3
+  strategy:
+    blueGreen:
+      activeService: nowchess-analysis-active
+      previewService: nowchess-analysis-preview
+      autoPromotionEnabled: true
+      previewReplicaCount: 1
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Rollout
 metadata:
   name: nowchess-tournament
   labels:

nowchess/base/nowchess-services.yaml

@@ -1,5 +1,35 @@
 apiVersion: v1
 kind: Service
+metadata:
+  name: nowchess-analysis-active
+  labels:
+    app.kubernetes.io/name: nowchess-analysis
+    app.kubernetes.io/part-of: nowchess
+spec:
+  selector:
+    app: nowchess-analysis
+  ports:
+    - protocol: TCP
+      port: 8087
+      targetPort: 8087
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nowchess-analysis-preview
+  labels:
+    app.kubernetes.io/name: nowchess-analysis
+    app.kubernetes.io/part-of: nowchess
+spec:
+  selector:
+    app: nowchess-analysis
+  ports:
+    - protocol: TCP
+      port: 8087
+      targetPort: 8087
+---
+apiVersion: v1
+kind: Service
 metadata:
   name: nowchess-account-active
 spec: