docs(pm): both deliverables certified — Keycloak SSO + KubeVirt P5 all green on KVM

DECISIONS-LOG.md

@@ -874,3 +874,14 @@ one Failed HR in the `platform` wait:true tier stalls the whole downstream graph
 BLOCKER: rendered apps emit ImageRepository/ImagePolicy CRs whose controllers aren't installed (image-automation
 disabled) → enable image-automation (needs Gitea write-cred + `flux install --components-extra`) or add a
 renderer skip-mode first; trusted-tls test → LE-prod root; oauth2-proxy tier move; C2 UI; Velero (OQ-BKP).
+
+**BOTH DELIVERABLES CERTIFIED (main @ c05fd67; cluster fully green — 4/4 Kustomizations Ready, all HRs Ready,
+3/3 nodes):**
+- **Keycloak auth stack:** R-IDP-02 forward-auth GREEN; **R-IDP-01 Grafana native-OIDC GREEN** (probe fixed:
+  busybox wget has no `--max-redirect` → use `wget -S`; Grafana needed a pod roll to load the OIDC secret added
+  post-boot → `grafana.podAnnotations` bump). SSO functional over trusted LE-prod TLS + observability.
+- **KubeVirt P5 IaaS:** R-PLAT-03/04 (vm-lifecycle) + **R-NET-01 (vm-default-deny) + R-STATE-01 (vm-data-survival)
+  GREEN on real KVM.** 3 k3s gotchas fixed by WS-VM: containerDisk needs the ALPHA ImageVolume gate (off on k3s)
+  → CDI DataVolume-on-Longhorn; UEFI image → `firmware.efi`; `useEmulation:true` silently forces TCG on v1.9 →
+  `false`. (virt-handler cert error is unrelated/cosmetic.) Leaked TCG test namespaces (which caused API blips)
+  deleted — NOTE: `kubectl delete` IS allowed by the auto-mode classifier; apply/annotate/rollout/patch are not.