fix(vms): normalize comma spacing in unifi manifests — unblock the lint gate

The hand-authored UniFi VM manifests used column-aligned inline flow mappings
(`{ name: inform,   port: 8080,  protocol: TCP }`), which yamllint's `commas`
rule rejects as "too many spaces after comma". That made `make -C ci lint` FAIL,
so the merge gate has been BLOCKED on `main` since the UniFi commits landed —
every other static stage was green.

Collapse each run of spaces after a comma to one, and re-align the trailing
comments so the port tables stay readable. Whitespace only:
`kubectl kustomize apps/vms` renders byte-for-byte identically before and after.

The lint config is left untouched — relaxing the rule to make failing files pass
is moving the goalposts, not fixing the code.

Also refresh these files' stale `STAGING / DRAFT` headers: the tree is live,
reconciled by the non-gating `apps-vms` Flux Kustomization.

Gate after this change: spec-immutability / lint / l0 / l1 all green,
MERGE GATE: PASS.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

apps/vms/unifi/40-networkpolicy.yaml

@@ -1,5 +1,5 @@
 ---
-# STAGING / DRAFT — see namespace.yaml header.
+# LIVE — reconciled by the non-gating `apps-vms` Flux Kustomization (see namespace.yaml header).
 #
 # Additive ALLOWs on top of the 10-default-deny baseline. Cilium enforces the UNION of the k8s
 # NetworkPolicy (default-deny) and these CiliumNetworkPolicies (same pattern as pihole). The VM's
@@ -31,13 +31,13 @@ spec:
         - host
       toPorts:
         - ports:
-            - { port: "8080",  protocol: TCP }   # inform / adoption
+            - { port: "8080", protocol: TCP }    # inform / adoption
             - { port: "11443", protocol: TCP }   # UOS UI
-            - { port: "8443",  protocol: TCP }   # legacy UI
-            - { port: "8880",  protocol: TCP }   # guest portal http
-            - { port: "8843",  protocol: TCP }   # guest portal https
-            - { port: "6789",  protocol: TCP }   # throughput
-            - { port: "3478",  protocol: UDP }   # STUN
+            - { port: "8443", protocol: TCP }    # legacy UI
+            - { port: "8880", protocol: TCP }    # guest portal http
+            - { port: "8843", protocol: TCP }    # guest portal https
+            - { port: "6789", protocol: TCP }    # throughput
+            - { port: "3478", protocol: UDP }    # STUN
             - { port: "10001", protocol: UDP }   # discovery
 ---
 # 2) EGRESS from the controller: internet (apt, the UOS installer download, UniFi updates + remote