feat(service-catalog): add representative media-service workload lane (closes #59)

[clubanderson]

Summary

Implements the first representative media-service validation lane under the service-catalog epic (#51). This PR closes #59 and makes the homelab service-catalog concrete rather than abstract.

Acceptance criteria check

• First representative media-service validation lane defined and implementable in repo-owned workflows/tests
• Minimum workload behaviors proven by the lane are stated (deployment, persistence, reachability, secret/env, teardown)
• GPU transcoding split explicitly → skipped with reference to feat: split GPU transcoding and passthrough from the base media lane #63
• RWX shared-media mount split explicitly → skipped with reference to feat: surface shared-storage and RWX blocker for homelab validation #62
• Dependencies on epic: homelab storage and role-template validation #52, epic: homelab access, TLS, and service security #53, and epic: homelab cluster substrate and fleet-client model #54 stated in test module docstring and docs

New files

tests/service_catalog/media/test_media_service.py

12 test methods in TestMediaServiceLane:

Group	Tests
Deployment	ready, pod Running, service endpoints
Config PVC	bound, capacity/access-modes, storage-class, writable
Data PVC	bound, capacity/access-modes, writable
Reachability	port 8096 in-cluster, cluster DNS
Env injection	PUID/PGID/TZ present with expected values
Rollout persistence	config + data sentinel survives pod replacement
Observability	df/findmnt/stat for both mounts
pytest.skip → #63; RWX → pytest.skip → #62

argo/workflow-templates/homelab-media-service.yaml

ArgoCD-managed WorkflowTemplate (same DAG pattern as homelab-substrate, homelab-storage):

• create-namespace → deploy-fixture → run-tests DAG
• deploy-fixture: homelab-media-config 1Gi PVC + homelab-media-data 10Gi PVC, Deployment with PUID/PGID/TZ env and dual mounts, ClusterIP Service on port 8096
• cleanup onExit handler with namespace deletion + wait-for-termination

argo/homelab-media-service.yaml

Workflow submit trigger (mirrors homelab-substrate.yaml pattern).

Updated files

docs/homelab-contracts.md

• Media-service row added to workload matrix (§1)
• Media-service minimum persistence contract added (§1)
• 'Media service lane: deferred' gap removed — now implemented
• §7 Media-Service Workload Lane added: full behavior table, out-of-scope table, dependency list
• §6 blockers table: feat: define representative media-service workload lane for homelab validation #59 → ✅ implemented

Dependencies

• epic: homelab storage and role-template validation #52 homelab storage (local-path PVC contract)
• epic: homelab access, TLS, and service security #53 homelab access (cluster DNS + reachability)
• epic: homelab cluster substrate and fleet-client model #54 homelab substrate (in-cluster scheduling)

[hanthor]

Service-catalog lane addition. Merge after foundational #202. LGTM.

[hanthor]

Superseded by #204. This PR implements media-service lane using direct homelab-media-service WorkflowTemplate, but #204 reimplements it using the canonical service-catalog-pipeline approach (consistent with contract #200). Close in favor of #204.

[hanthor]

Review: Approved ✅

Part of the structured service-catalog project build-up. Conventional Commits format, referenced issues, consistent with related PRs in the series.