docs(vpn-egress): reflect ADR-0015 node-tunnel egress, retire gluetun narrative

The in-cluster Gluetun gateway is retired; VPN egress is now a node-level host
OpenVPN split-tunnel (Ansible role vpn_egress_gateway) steered by a Cilium
Egress Gateway policy with a host nftables kill-switch (ADR-0015). Credentials
moved host-side to the Ansible vault. Update docs/comments only:

- platform/vpn-egress/README.md: rewrite for ADR-0015 (live + conformance-green);
  drop the resolved "option 1 not viable with Gluetun" finding to a brief history note.
- platform/kustomization.yaml: Phase 3 comment -> node tunnel + Cilium steering.
- platform/kyverno/.../require-egress-class-label.yaml: ADR-0013 -> ADR-0015 steering.
- schemas/servicedefinition.schema.json: egress=vpn description -> node tunnel + Cilium.
- clusters/base/cluster-vars.yaml: reframe PIA_REGION / CLUSTER_POD_CIDR WHY comments
  to ADR-0015 (Cilium excludedCIDRs); both keys retained (still referenced/documented).
- platform/vpn-egress/namespace.yaml: no privileged gateway pod under ADR-0015.
- pia-credentials.sops.yaml / pia-custom-ovpn.sops.yaml: comment headers only note
  they are now UNUSED (creds host-side), retained pending cleanup; payloads untouched.

No runtime manifest behavior, alert exprs, kustomization resources, or SOPS payloads
changed. No spec-repo edits.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/kyverno/policies/require-egress-class-label.yaml

@@ -2,7 +2,8 @@
 # Spec: docs/03 "Egress is a declared property"; docs/13 `egress: internet | vpn`.
 #
 # The egress class is enforced OUTSIDE the service (Cilium Egress Gateway selects
-# pods by label -> steers `vpn` pods through the shared PIA/Gluetun gateway, ADR-0013).
+# pods by label -> steers `vpn` pods out the egress-gateway node's host tun0 VPN
+# tunnel, ADR-0015).
 # For that steering to be possible the label MUST exist on the pod and be one of the
 # two valid classes. A missing/typo'd class would silently fall back to the plain
 # internet path -- a fail-OPEN egress leak -- so we require it explicitly (fail-closed