Component catch-up batch 1: external-dns 1.21, oauth2-proxy 10.x, Alloy 1.x, CNPG in-place flag

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/monitoring/alloy.yaml

@@ -12,7 +12,7 @@ spec:
   chart:
     spec:
       chart: alloy
-      version: ">=0.10.0 <1.0.0"   # TODO(WS-OBS): pin at bring-up; Renovate maintains
+      version: ">=1.0.0 <2.0.0"   # k8s-1.36 catch-up (1.x line). Renovate maintains
       sourceRef:
         kind: HelmRepository
         name: grafana