Add experimental ingestion module for dlt (data load tool)

[RonaldHensbergen]

Summary

Implements #589: adds an experimental ingestion module for dlt (data load tool), following the same pattern the dbt transformation module established for experimental, one-shot-job modules.

Module (modules-experimental/ingestion/dlt/)

• module.yaml: metadata.category: ingestion, productionSuitable: false. configSchema covers pipeline.{hostPath,containerPath}, entrypointScript (default pipeline.py), destinationDatabase (contract binding, required), destinationDataset (default raw), pipelineName (default cds_dlt_pipeline).
• consumes: destination-database (kind sql-database, required). No provides — like dbt, this is a one-shot job with no live service to expose.
• implementation.compose.services.dlt-run: one-shot (restart: "no", healthcheck disabled), read_only: true, cap_drop: [ALL], security_opt: [no-new-privileges:true], tmpfs for /tmp and /home/dlt/.dlt, read-only bind mount of the pipeline directory, and a named volume (dlt-state) for persisted pipeline state.
• Maps ${bindings.destination-database.connectionUri} directly onto DESTINATION__POSTGRES__CREDENTIALS — dlt's own env-var convention for a full postgresql:// URI, so no CDS-side transformation is needed.

Image (images/dlt/)

• Multi-stage build on python:3.14-slim (same digest pin as Dagster/dbt). Unlike dbt, dlt supports Python 3.10–3.14, so no base-image downgrade was needed.
• Pinned to dlt[postgres]==1.30.0 (latest stable, verified via PyPI).
• Non-root dlt user, pip self-uninstalled in both build stages (matches the Dagster/dbt CVE/SBOM-noise avoidance pattern).

Example pipeline (workdirs/dlt/pipeline.py)

Minimal @dlt.resource-based example meant to be replaced by real pipelines.

Workflow wiring (mirrors the dbt module exactly)

• .github/workflows/publish-images.yml: context="." for both GHCR and Docker Hub publish jobs, plus a dlt) case in "Determine version" that extracts the version from images/dlt/requirements.txt.
• .github/workflows/docker-smoke-test.yml, .github/workflows/image-security-scan.yml: context="." for images/dlt/*.
• tests/fixtures/signed-images.json: placeholder cds-dlt entry (non-placeholder digest); CI's update-fixture job will fill in the real digest after first publish to main, same as it did for dbt.

Docs

• docs/architecture.md: new Ingestion layer row.
• docs/image-signing.md / docs/image-scanning.md: dlt tag/versioning notes.
• docs/roadmap.md: dlt added to Experimental Components.
• modules-experimental/ingestion/dlt/README.md / images/dlt/README.md: module and image docs, mirroring the dbt module's README structure.

Out of scope (left for follow-up, matching dbt's own precedent)

• No demo profile wiring ingestion/dlt into a stable profiles/ stack.
• No Dagster-triggered execution — dlt currently only runs as a standalone one-shot job via docker compose run. Follow-up work could add a contract letting Dagster trigger dlt runs directly.

Testing

• make check — 614 tests, ruff, yamllint, markdownlint all pass.
• yamllint . — clean (only unrelated warnings in vendored .venv packages).
• Manually validated via a scratch profile wiring ingestion/dlt → warehouse/postgres: cds validate, cds render, and cds test (plan/render stages) all pass; confirmed the rendered Compose service correctly resolves the sql-database contract binding into DESTINATION__POSTGRES__CREDENTIALS.
• python -m unittest tests.test_standalone_module_profile tests.test_modules_no_committed_secrets -v — pass (the generic coverage new experimental modules get for free, matching dbt's own test footprint of zero bespoke test files).

Resolves #589