fix(cloudflared): auditable Service+ServiceMonitor scrape; placeholder-only template value

servicemonitor-ports-resolve could not audit a PodMonitor with no in-repo
Service, and no-plaintext-secrets requires a template's secret value to be a
bare placeholder.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

platform/cloudflared/kustomization.yaml

@@ -15,7 +15,7 @@ resources:
   # Namespace default-deny + the Prometheus scrape allow + the egress CiliumNetworkPolicy. Keep
   # them in ONE file: a baseline without its scrape allow silently empties the TSDB.
   - networkpolicy.yaml
-  - podmonitor.yaml
+  - servicemonitor.yaml  # headless metrics Service + ServiceMonitor (:2000)
   - alerts.yaml
   # The tunnel credentials JSON — the ONE secret here. SOPS-encrypted, decrypted per-env by the
   # `cloudflared` Flux Kustomization (both overlays patch it), referenced by name only. Its