fix(infra): use emptyDir for training output, fix S3 credential mapping

- Switch output volume from PVC to emptyDir (sidecar uploads to S3)
- Map s3-credentials secret keys to AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY
  (object_store crate expects standard AWS env var names)
- Fix data-dir path to include /futures-baseline subdirectory

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infra/k8s/training/job-template.yaml

@@ -47,9 +47,16 @@ spec:
               value: http://ml-training-service.foxhunt.svc.cluster.local:50053
             - name: RUST_LOG
               value: info
-          envFrom:
-            - secretRef:
-                name: s3-credentials
+            - name: AWS_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: s3-credentials
+                  key: access-key
+            - name: AWS_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: s3-credentials
+                  key: secret-key
           volumeMounts:
             - name: output
               mountPath: /output
@@ -74,7 +81,7 @@ spec:
           command: ["/usr/local/bin/$(TRAINING_BINARY)"]
           args:
             - "--symbol=ES.FUT"
-            - "--data-dir=/data"
+            - "--data-dir=/data/futures-baseline"
             - "--output-dir=/output"
           env:
             - name: TRAINING_BINARY
@@ -103,5 +110,5 @@ spec:
           persistentVolumeClaim:
             claimName: training-data-pvc
         - name: output
-          persistentVolumeClaim:
-            claimName: training-output-pvc
+          emptyDir:
+            sizeLimit: 2Gi