fix(vms): normalize comma spacing in unifi manifests — unblock the lint gate

The hand-authored UniFi VM manifests used column-aligned inline flow mappings
(`{ name: inform,   port: 8080,  protocol: TCP }`), which yamllint's `commas`
rule rejects as "too many spaces after comma". That made `make -C ci lint` FAIL,
so the merge gate has been BLOCKED on `main` since the UniFi commits landed —
every other static stage was green.

Collapse each run of spaces after a comma to one, and re-align the trailing
comments so the port tables stay readable. Whitespace only:
`kubectl kustomize apps/vms` renders byte-for-byte identically before and after.

The lint config is left untouched — relaxing the rule to make failing files pass
is moving the goalposts, not fixing the code.

Also refresh these files' stale `STAGING / DRAFT` headers: the tree is live,
reconciled by the non-gating `apps-vms` Flux Kustomization.

Gate after this change: spec-immutability / lint / l0 / l1 all green,
MERGE GATE: PASS.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

apps/vms/unifi/10-default-deny.yaml

@@ -1,5 +1,5 @@
 ---
-# STAGING / DRAFT — see namespace.yaml header.
+# LIVE — reconciled by the non-gating `apps-vms` Flux Kustomization (see namespace.yaml header).
 #
 # Default-deny baseline (R-NET-01): deny all ingress + egress, allow ONLY DNS to the
 # in-cluster resolver. Identical shape to the rendered pihole/app baseline. The VM's