chore: add CodeRabbit AI review config

.coderabbit.yaml

@@ -0,0 +1,84 @@
+language: en-US
+tone_instructions: "Terse, technical, fragments OK. Skip pleasantries."
+early_access: false
+
+reviews:
+  profile: assertive
+  request_changes_workflow: false
+  high_level_summary: true
+  poem: false
+  review_status: false
+  changed_files_summary: true
+  sequence_diagrams: false
+
+  path_filters:
+    - "!**/*.md"
+    - "!CHANGELOG*"
+    - "!__pycache__/**"
+    - "!**/*.pyc"
+    - "!**/renovate.json"
+
+  path_instructions:
+    - path: "controller.py"
+      instructions: |
+        Kopf operator reconciling GPU-node maintenance against vSphere. Flag: missing await/async correctness,
+        pyvmomi session leaks, unbounded retry without backoff, kopf handler idempotency violations,
+        partial state on exception (must be safe to re-enter). Watch state-machine transitions for stranded VMs.
+    - path: "Dockerfile"
+      instructions: |
+        Pin base image digest if floating. Multi-stage acceptable.
+    - path: "chart/**"
+      instructions: |
+        Helm chart. Flag missing resource limits, RBAC scope creep, hostPath without need.
+    - path: "chart/**/values.yaml"
+      instructions: |
+        Defaults must be safe (dry-run on by default, conservative drain timeouts).
+
+  auto_review:
+    enabled: true
+    auto_incremental_review: true
+    ignore_title_keywords:
+      - "WIP"
+      - "[skip-review]"
+    drafts: false
+    base_branches:
+      - "main"
+    ignore_usernames:
+      - "renovate[bot]"
+      - "github-actions[bot]"
+
+  tools:
+    ruff:
+      enabled: true
+    pylint:
+      enabled: true
+    gitleaks:
+      enabled: true
+    hadolint:
+      enabled: true
+    checkov:
+      enabled: true
+    yamllint:
+      enabled: true
+    markdownlint:
+      enabled: false
+    languagetool:
+      enabled: false
+
+  finishing_touches:
+    docstrings:
+      enabled: false
+    unit_tests:
+      enabled: false
+
+chat:
+  auto_reply: true
+
+knowledge_base:
+  opt_out: false
+  learnings:
+    scope: local
+  issues:
+    scope: local
+  pull_requests:
+    scope: local