fix(cdi): single-replica scratch class + 40Gi UniFi disk (fix insufficient-storage import)

The UniFi Block import got past the device-permission fix but then failed
ReplicaSchedulingFailure / "insufficient storage": CDI sizes scratch ~= the disk
virtual size and, on the default 3-replica `longhorn` class, the ~60Gi scratch x3
(189G) on top of the disk's x3 (180G) overflowed the Longhorn tier (~125G/node).

- platform/longhorn/storageclasses.yaml: NEW `longhorn-scratch` StorageClass
  (numberOfReplicas: 1) — CDI scratch is ephemeral/throwaway, replicating it 3x is
  waste; if a node dies mid-import CDI just retries.
- platform/kubevirt/cdi-cr.yaml: spec.config.scratchSpaceStorageClass ->
  longhorn-scratch.
- apps/vms/unifi/20-datavolume.yaml: boot disk 60Gi -> 40Gi (UOS min is 25Gi;
  40Gi is comfortable for a home site and lighter on the replicated tier).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/kubevirt/cdi-cr.yaml

@@ -18,9 +18,10 @@ spec:
   workload: {}
   config:
     # CDI's transient scratch space (used while converting/decompressing an imported image) is carved
-    # from the replicated Longhorn tier — the same StorageClass the final VM DataVolumes bind to, so
-    # there is no second storage tier to reason about. (docs/04, ADR-0003.)
-    scratchSpaceStorageClass: longhorn
+    # from a dedicated SINGLE-replica Longhorn class — scratch is ephemeral/throwaway, so replicating
+    # it 3x is waste and, for a large VM disk, the 3x scratch on top of the 3x final disk exhausts the
+    # Longhorn tier (ReplicaSchedulingFailure). See platform/longhorn/storageclasses.yaml. (docs/04, ADR-0003.)
+    scratchSpaceStorageClass: longhorn-scratch
     # Reserve headroom on the filesystem-mode PVC for qcow2 metadata so an import never wedges a volume
     # at 100%. 0.055 is CDI's documented default; pinned here so it is explicit and reviewable.
     filesystemOverhead: