feat(storage): CSI snapshots + smart-clone + migratable RWX for KubeVirt live-migration

Adds the VM/CDI storage tier approved by the PM (RWX for live-migration):

- platform/external-snapshotter (NEW, controllers pass): the cluster-singleton
  snapshot.storage.k8s.io control plane (CRDs + snapshot-controller in
  kube-system), pinned v8.2.0 (Kubernetes deps aligned to 1.31 since v8.1.0;
  this cluster is k3s v1.31.5). These CRDs were absent — only snapshots.longhorn.io
  and kubevirt.io snapshot CRDs existed.
- platform/longhorn/volumesnapshotclass.yaml (NEW, platform-config): the
  driver.longhorn.io VolumeSnapshotClass (type: snap, in-cluster).
- platform/kubevirt/cdi-storageprofiles.yaml (NEW, platform-config): StorageProfile
  longhorn -> cloneStrategy: snapshot; StorageProfile longhorn-vm -> snapshot clone
  + claimPropertySets RWX/Block. Non-degraded default virt class clears
  CDIDefaultStorageClassDegraded.
- platform/longhorn/storageclasses.yaml: NEW longhorn-vm StorageClass —
  migratable: "true" (Longhorn's KubeVirt-live-migration knob; RWX/Block-only on
  1.7.3), is-default-virt-class (NOT the k8s default; longhorn stays RWO default).
- platform/kubevirt/kubevirt-cr.yaml: comment only — LiveMigration is GA on v1.9
  (no feature gate); no cluster-wide evictionStrategy (would wedge RWO-disk drains);
  live-migration stays per-VM opt-in on a longhorn-vm disk.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/external-snapshotter/README.md

@@ -0,0 +1,31 @@
+# external-snapshotter (CSI snapshot control plane)
+
+Installs the cluster-singleton [kubernetes-csi/external-snapshotter](https://github.com/kubernetes-csi/external-snapshotter):
+
+- the `snapshot.storage.k8s.io` CRDs — `VolumeSnapshot`, `VolumeSnapshotContent`,
+  `VolumeSnapshotClass` (v1, GA);
+- the **snapshot-controller** Deployment (into `kube-system`, the upstream default) that
+  reconciles those objects against any CSI driver's `CreateSnapshot`/`DeleteSnapshot`.
+
+Neither k3s nor the Longhorn chart ships this. It is a prerequisite for:
+
+1. **`VolumeSnapshotClass` (driver.longhorn.io)** — see
+   `../longhorn/volumesnapshotclass.yaml` (applied by `platform-config`).
+2. **CDI snapshot smart-clone** — the CDI `StorageProfile`s set `cloneStrategy: snapshot`
+   (see `../kubevirt/cdi-storageprofiles.yaml`); CDI clones VM disks by taking a CSI
+   `VolumeSnapshot` instead of a slow host-assisted byte copy.
+3. Clearing the **`CDIDefaultStorageClassDegraded`** alert — a default virtualization
+   StorageClass must support *both* smart-clone *and* ReadWriteMany.
+
+## Wiring
+
+- **Pass:** `platform` (controllers). Registers the CRDs.
+- The `VolumeSnapshotClass` / `StorageProfile` CRs that consume the CRDs live in the
+  `platform-config` pass (`dependsOn: platform`), per the controllers/configs split.
+
+## Version
+
+Pinned to **v8.2.0** (Renovate-maintained). The v8.x line aligned to Kubernetes 1.31 at
+v8.1.0; this cluster is k3s v1.31.5. The snapshot-controller image is re-pinned to the same
+tag via the kustomization `images` transformer (the upstream setup manifest lags on the image
+tag).

platform/external-snapshotter/kustomization.yaml

@@ -0,0 +1,44 @@
+---
+# external-snapshotter — the cluster-wide CSI snapshot control plane (Phase 2, storage).
+#
+# WHY: Longhorn's CSI driver (driver.longhorn.io) can create CSI VolumeSnapshots, but the
+# `snapshot.storage.k8s.io` API (VolumeSnapshot / VolumeSnapshotContent / VolumeSnapshotClass)
+# and the snapshot-controller that reconciles them are NOT part of k3s or of Longhorn — they are
+# a SEPARATE, cluster-singleton component (kubernetes-csi/external-snapshotter). Without it the
+# CRDs are absent (only `snapshots.longhorn.io` + the kubevirt.io snapshot CRDs exist), so:
+#   * no VolumeSnapshotClass can be created (item 2), and
+#   * CDI cannot do SNAPSHOT smart-clone (item 3) — it falls back to slow host-assisted `copy`,
+#     which leaves the default virt StorageClass "degraded" (CDIDefaultStorageClassDegraded).
+# Installing it here (controllers pass) registers the CRDs; the VolumeSnapshotClass + the CDI
+# StorageProfiles that CONSUME them are applied by platform-config (dependsOn: platform).
+#
+# CONTROLLERS/CONFIGS SPLIT (F-MON1): this is the CONTROLLERS half. The snapshot.storage.k8s.io
+# CRDs are registered by the `client/config/crd` base below; the snapshot-controller Deployment
+# (into kube-system, upstream default) reconciles VolumeSnapshots. Custom resources that use these
+# CRDs (the Longhorn VolumeSnapshotClass, item 2) live in platform-config so the CRDs exist first.
+#
+# VERSION (Renovate-maintained): external-snapshotter v8.2.0.
+#   * The v8.x line updated its Kubernetes deps to 1.31 at v8.1.0 (this cluster is k3s v1.31.5),
+#     so v8.2.x is the conservative, version-matched choice — newer than the 1.31 alignment,
+#     older than the v8.4/v8.5 churn.
+#   * snapshot.storage.k8s.io CRDs are served at v1 (GA) — driver.longhorn.io speaks v1, so
+#     Longhorn CSI snapshots + CDI snapshot-clone work against these CRDs.
+#   * The upstream setup manifest pins the controller image to an older v8.0.x tag; the `images`
+#     transformer below re-pins it to v8.2.0 so the running controller matches the CRD version.
+#   * The `client/config/crd` base also ships the beta VolumeGroupSnapshot CRDs; that feature is
+#     gated OFF in the controller (no --enable-volume-group-snapshots arg), so they are inert.
+#
+# Kustomize loads these as REMOTE bases (github.com/...?ref=<tag>) — the same remote-manifest
+# pattern platform/kubevirt uses for the KubeVirt/CDI operators; Flux's kustomize-controller
+# fetches them identically at reconcile.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # renovate: datasource=github-releases depName=kubernetes-csi/external-snapshotter
+  - https://github.com/kubernetes-csi/external-snapshotter/client/config/crd?ref=v8.2.0
+  # renovate: datasource=github-releases depName=kubernetes-csi/external-snapshotter
+  - https://github.com/kubernetes-csi/external-snapshotter/deploy/kubernetes/snapshot-controller?ref=v8.2.0
+images:
+  # Re-pin the controller image to the base ref so controller == CRD version (see header note).
+  - name: registry.k8s.io/sig-storage/snapshot-controller
+    newTag: v8.2.0