fix(cloudflared): auditable Service+ServiceMonitor scrape; placeholder-only template value

servicemonitor-ports-resolve could not audit a PodMonitor with no in-repo
Service, and no-plaintext-secrets requires a template's secret value to be a
bare placeholder.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

conformance/tests/l0-static/alert-metrics-have-scrape-targets/check.sh

@@ -413,13 +413,14 @@ SCRAPE_OWNERS: list[dict] = [
     },
     # ── ADDED 2026-11-08 (feat/cloudflare-tunnel). A NEW OWNER, NOT A RELAXED ASSERTION. ───────
     # Purely additive, the same shape as the kured entry: it registers the cloudflared_* family
-    # and the PodMonitor that scrapes it, and makes the check STRICTER for that component.
+    # and the Service+ServiceMonitor that scrapes it, and makes the check STRICTER for that component.
     {
-        "owner": "cloudflared: the PodMonitor on the `metrics` (:2000) container port",
+        "owner": "cloudflared: headless metrics Service + ServiceMonitor on port `metrics` (:2000)",
         "prefixes": ("cloudflared_",),
-        "file": "platform/cloudflared/podmonitor.yaml",
+        "file": "platform/cloudflared/servicemonitor.yaml",
         "require": [
-            r"^kind:\s*PodMonitor\s*$",
+            r"^kind:\s*ServiceMonitor\s*$",
+            r"^kind:\s*Service\s*$",
             r"^\s*-\s*port:\s*metrics\s*$",
         ],
         "forbid": [],