fix(stands): E2E and staging seed their stores explicitly after P0-2

Both push-only lanes went red on the audit merge for the same reason:
they still relied on the API provisioning and seeding its store on
boot, which audit P0-2 removed. E2E hit 503/400/timeouts against an
unprovisioned ClickHouse; the staging smoke got 404 for
ORD-20260404-1001 from an empty embedded store. Both lanes were green
on the previous main commit.

- docker-compose.e2e.yml: one-shot serving-init service runs
  'python -m src.serving.provision --schema --seed' against the
  in-stack ClickHouse before the API starts — the same job
  docker-compose.prod.yml already runs; the API now depends on its
  successful completion. The stale workflow comment claiming the API
  seeds on boot is corrected.
- k8s/staging/values-staging.yaml: AGENTFLOW_SEED_ON_BOOT=true — the
  explicit demo-seed opt-in P0-2 left for exactly this ephemeral
  embedded profile. Verified live locally: fresh store + seed-on-boot
  boots, the smoke probes pass (entity ORD-20260404-1001 -> 200,
  'Show me top 3 products' -> rows).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: JuliaEdom

.github/workflows/e2e.yml

@@ -105,9 +105,10 @@ jobs:
       - name: Run E2E tests
         run: pytest tests/e2e/ -v --tb=short --timeout=60
 
-      # The API seeds ClickHouse only when it boots on the shipped ClickHouse
-      # serving profile (config/serving.yaml), so rows in agentflow.orders_v2
-      # prove the E2E stack exercised the real engine, not a DuckDB fallback.
+      # The one-shot serving-init service provisions and seeds ClickHouse
+      # before the API starts (the API itself no longer touches the store on
+      # boot — audit P0-2), so rows in agentflow.orders_v2 prove the E2E stack
+      # exercised the real engine, not a DuckDB fallback.
       - name: Verify ClickHouse serving path
         run: |
           orders=$(docker compose -f docker-compose.e2e.yml exec -T clickhouse \

docker-compose.e2e.yml

@@ -86,6 +86,32 @@ services:
           cpus: "0.50"
           memory: 512M
 
+  serving-init:
+    # The API stopped provisioning and seeding the serving store on boot
+    # (audit P0-2), so the stack lays the schema and the documented demo
+    # entities down itself before the API starts — the same one-shot job
+    # docker-compose.prod.yml runs, against the in-stack ClickHouse the E2E
+    # smoke suite queries.
+    build:
+      context: .
+      dockerfile: Dockerfile.api
+    depends_on:
+      clickhouse:
+        condition: service_healthy
+    environment:
+      AGENTFLOW_SERVING_CONFIG: /app/config/serving.yaml
+      DUCKDB_PATH: /app/data/agentflow.duckdb
+      CLICKHOUSE_HOST: clickhouse
+      CLICKHOUSE_PORT: 8123
+      CLICKHOUSE_DATABASE: agentflow
+      CLICKHOUSE_USER: default
+      CLICKHOUSE_PASSWORD: ""
+    command: ["python", "-m", "src.serving.provision", "--schema", "--seed"]
+    restart: "no"
+    volumes:
+      - agentflow-api-data:/app/data
+      - ./config:/app/config:ro
+
   agentflow-api:
     build:
       context: .
@@ -99,6 +125,8 @@ services:
         condition: service_healthy
       clickhouse:
         condition: service_healthy
+      serving-init:
+        condition: service_completed_successfully
     ports:
       - "8000:8000"
     environment:

k8s/staging/values-staging.yaml

@@ -45,6 +45,13 @@ config:
 extraEnv:
   - name: AGENTFLOW_WEBHOOKS_FILE
     value: /data/e2e-webhooks.yaml
+  # Staging is an ephemeral kind cluster serving from the per-pod embedded
+  # DuckDB, and the smoke tests query the documented demo entities
+  # (ORD-20260404-1001 …). Boot seeding is the explicit opt-in that audit
+  # P0-2 left for exactly this profile — off by default everywhere else, so
+  # no real store ever receives demo rows for merely being empty.
+  - name: AGENTFLOW_SEED_ON_BOOT
+    value: "true"
 
 # Staging is an ephemeral kind cluster torn down after each CI run. The
 # hashes below correspond to the same plaintext fixtures committed in