flux(platform): temp-disable oauth2-proxy to break cold-start OIDC deadlock (re-enable after platform-config green)

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/kustomization.yaml

@@ -29,7 +29,11 @@ resources:
   #      Cluster CRs + ServiceMonitors + HTTPRoutes are in platform-config (dependsOn platform). ----
   - cnpg               # CloudNativePG operator (DB backend for Keycloak) — ghcr.io images (not Bitnami)
   - keycloak           # Keycloak Operator (quay.io images) + SOPS admin credential
-  - oauth2-proxy       # forward-auth for non-OIDC UIs — wildcard cert now LE-prod-trusted + split-horizon DNS live
+  # - oauth2-proxy     # TEMP-DISABLED (cold-start deadlock): oauth2-proxy OIDC-discovers Keycloak,
+  #                    # which lives in platform-config (dependsOn platform) — so it crashloops and
+  #                    # gates platform Ready on a fresh cluster. Re-enable AFTER platform-config is
+  #                    # green (Keycloak live). Proper fix = move to a post-platform-config tier
+  #                    # (DECISIONS-LOG oauth2-proxy FOLLOW-UP).
   # FOLLOW-UP: move oauth2-proxy to a post-platform tier (dependsOn platform-config) so it can never
   # block its own dependencies (cert-manager/gateway) from reconciling — see DECISIONS-LOG.
   # ---- Later phases: enabled when their phase opens ----