Add Ambush Streams Centaur overlay

[ecejas]

Why

Centaur operators need a native, low-friction way to give selected users and channels access to Ambush Streams without exposing credentials inside agent sandboxes. Ambush already has dedicated Codex, Claude, and standalone-skill distributions; this adds the Centaur distribution with deployment-level permissions and a shared integration identity.

How

• Add an installable ambush-streams Centaur tool for stream lifecycle and emission review.
• Declare host-scoped AMBUSH_API_KEY injection through iron-proxy for api.ambush.ai.
• Map the production API's legacy feed fields to Ambush Streams terminology in the CLI and bundled skill.
• Require exact-ID confirmation before permanent deletion and avoid unsafe automatic create retries.
• Document the complete operator flow: key creation, overlay source, secret storage, allowlist, role grant, and fresh-sandbox verification.
• Add a mergeable Helm-values example and Python 3.11–3.13 CI.

Verification

• uv run --no-project --with pytest --with httpx --with typer --with rich pytest -q — 22 passed
• uvx ruff check .
• uvx ruff format --check .
• actionlint .github/workflows/test.yml
• Parsed the workflow and Helm example as YAML
• Built the sdist and wheel, installed the wheel into a clean virtual environment, and ran ambush-streams --help
• Verified the wheel contains only the intended runtime package
• Verified Centaur's own tool-shim discovery resolves ambush-streams to the expected entry point
• Verified the production health endpoint returns 200 and unauthenticated /api/v1/me returns the expected 401 contract

An authenticated production smoke test was not run because no dedicated Centaur Ambush key was placed in the development environment.