fix(cloudflared): auditable Service+ServiceMonitor scrape; placeholder-only template value

servicemonitor-ports-resolve could not audit a PodMonitor with no in-repo
Service, and no-plaintext-secrets requires a template's secret value to be a
bare placeholder.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

platform/cloudflared/alerts.promtool-test.yaml

@@ -33,7 +33,7 @@ tests:
     name: nothing scraped at all - TunnelDown still fires (no self-silencing on absence)
     input_series:
       # kube-state-metrics says both pods are Available, but no cloudflared series exists — the
-      # broken-PodMonitor / dropped-scrape case. The rule must not read this as healthy.
+      # broken-ServiceMonitor / dropped-scrape case. The rule must not read this as healthy.
       - series: 'kube_deployment_status_replicas_available{namespace="cloudflared",deployment="cloudflared"}'
         values: '2x60'
     promql_expr_test: