feat: pipeline on/off toggle with per-stage Helm control

- Added pipelineEnabled flag to Helm values (default: true)
- Worker services (scheduler, ingestion, parser, extractor, aggregation,
  recommendation, broker-adapter, lake-publisher) scale to 0 when disabled
- API services always run regardless of toggle
- Redis-based runtime toggle: POST /api/ops/pipeline/toggle
- Scheduler checks the flag before each cycle
- Frontend: green/red Pipeline ON/OFF button on the pipeline page
- Beta defaults to pipelineEnabled: false
- Base values.yaml: blanked external URLs (Ollama, Polygon, Alpaca)
  so stages only connect to what they explicitly configure

.github/workflows/build.yml

@@ -227,3 +227,55 @@ jobs:
         with:
           name: inttest-results
           path: inttest-results.json
+
+  beta-gate:
+    needs: [integration-test]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: self-hosted-gremlin
+    permissions:
+      contents: read
+      packages: read
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install kubectl
+        run: |
+          if ! command -v kubectl &> /dev/null; then
+            curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
+            chmod +x kubectl
+            sudo mv kubectl /usr/local/bin/kubectl
+          fi
+          kubectl version --client
+
+      - name: Install Helm
+        run: |
+          if ! command -v helm &> /dev/null; then
+            curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | sudo bash
+          fi
+          helm version
+
+      - name: Configure kubectl
+        run: |
+          if [ -f /var/run/secrets/kubernetes.io/serviceaccount/token ]; then
+            kubectl config set-cluster in-cluster \
+              --server=https://kubernetes.default.svc \
+              --certificate-authority=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+            kubectl config set-credentials runner \
+              --token="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)"
+            kubectl config set-context runner --cluster=in-cluster --user=runner
+            kubectl config use-context runner
+          fi
+          kubectl cluster-info || echo "WARNING: kubectl cannot reach cluster API"
+
+      - name: Run beta gate (deploy → test → promote)
+        run: |
+          bash infra/inttest/promote.sh \
+            --image-tag ${{ github.sha }} \
+            --results-file beta-gate-results.json
+
+      - name: Upload beta gate results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: beta-gate-results
+          path: beta-gate-results.json