docs(vpn-egress): reflect ADR-0015 node-tunnel egress, retire gluetun narrative

The in-cluster Gluetun gateway is retired; VPN egress is now a node-level host
OpenVPN split-tunnel (Ansible role vpn_egress_gateway) steered by a Cilium
Egress Gateway policy with a host nftables kill-switch (ADR-0015). Credentials
moved host-side to the Ansible vault. Update docs/comments only:

- platform/vpn-egress/README.md: rewrite for ADR-0015 (live + conformance-green);
  drop the resolved "option 1 not viable with Gluetun" finding to a brief history note.
- platform/kustomization.yaml: Phase 3 comment -> node tunnel + Cilium steering.
- platform/kyverno/.../require-egress-class-label.yaml: ADR-0013 -> ADR-0015 steering.
- schemas/servicedefinition.schema.json: egress=vpn description -> node tunnel + Cilium.
- clusters/base/cluster-vars.yaml: reframe PIA_REGION / CLUSTER_POD_CIDR WHY comments
  to ADR-0015 (Cilium excludedCIDRs); both keys retained (still referenced/documented).
- platform/vpn-egress/namespace.yaml: no privileged gateway pod under ADR-0015.
- pia-credentials.sops.yaml / pia-custom-ovpn.sops.yaml: comment headers only note
  they are now UNUSED (creds host-side), retained pending cleanup; payloads untouched.

No runtime manifest behavior, alert exprs, kustomization resources, or SOPS payloads
changed. No spec-repo edits.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

clusters/base/cluster-vars.yaml

@@ -37,17 +37,18 @@ data:
   KYVERNO_FORCE_FAILURE_POLICY_IGNORE: "false"    # dev: "true" (chart forceFailurePolicyIgnore = fail-open)
   KYVERNO_ADMISSION_REPLICAS: "3"                 # dev: 1 (no HA needed to iterate)
 
-  # --- egress / VPN (Phase 3, ADR-0013) — consumed by platform/vpn-egress/gluetun-gateway.yaml ---
-  PIA_REGION: "SE Stockholm"                 # operator's choice (Sweden). PIA's OpenVPN region name is
-                                             # "SE Stockholm" — PF-capable (NOT "SE Streaming Optimized",
-                                             # which lacks PF; NOT a US region, which also lack PF)
-  CLUSTER_POD_CIDR: "10.0.0.0/16"            # Gluetun FIREWALL_OUTBOUND_SUBNETS (bypass for steered client pods).
-                                             # NARROWED from the /8 cluster-pool: /8 overlaps PIA's tunnel gateway
-                                             # 10.31.128.1, so gluetun routed PIA's own PF gateway AROUND the tunnel
-                                             # → port forwarding timed out. /16 covers actual pod allocations
-                                             # (Cilium assigns /24 per node from 10.0.0.0 up) and excludes 10.31.x.
-  # NOTE: Phase-3 VPN uses PIA's default OpenVPN UDP port + gluetun's server-list UPDATER (the bundled list
-  # was stale, dialing retired IPs). Port/region are not cluster-vars (see gluetun-gateway.yaml). See DECISIONS-LOG.
+  # --- egress / VPN (Phase 3, ADR-0015) — node-level host OpenVPN tunnel steered by Cilium Egress
+  #     Gateway (platform/vpn-egress/egress-steering.yaml). No in-cluster gateway pod. ---
+  PIA_REGION: "SE Stockholm"                 # PF-capable PIA region (Sweden). Under ADR-0015 the tunnel is
+                                             # host-side (Ansible vault / the node's .ovpn per docs/07), so this
+                                             # is now a reference default only — retained, not substituted into
+                                             # any manifest. ("SE Stockholm" is PF-capable; NOT "SE Streaming
+                                             # Optimized" / a US region, which lack PF.)
+  CLUSTER_POD_CIDR: "10.0.0.0/16"            # Documents the Cilium cluster-pool pod CIDR that the egress-steering
+                                             # CiliumEgressGatewayPolicy carves out of the tunnel via excludedCIDRs
+                                             # (kept on the LOCAL datapath, never SNAT'd out tun0). The policy
+                                             # currently excludes the whole /8 RFC1918 range; this /16 records the
+                                             # actual pod allocations (Cilium assigns /24 per node from 10.0.0.0 up).
 
   # --- identity / auth (ADR-0014) ---
   KEYCLOAK_REPLICAS: "1"                     # dev 1 | prod 2 (HA)