T-0.1 Flux GitOps layout + dev/prod overlays + platform component skeletons (R-GITOPS-01/03, R-ENV-02, R-PLAT-01)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/image-automation/image-update-automation.yaml

@@ -0,0 +1,39 @@
+---
+# Flux image-update-automation — the CLUSTER-WIDE write-back engine for hands-off image tag advances
+# (ADR-0009, R-UPD-02). It scans registries per each service's ImagePolicy and commits the resolved
+# version back to git — no human/AI authors the bump. Phase 0 STUB.
+#
+# SCOPE: this dir holds ONLY the cluster-wide ImageUpdateAutomation + git write-back settings.
+# Per-service `ImageRepository`/`ImagePolicy` are rendered from each ServiceDefinition's `update`
+# block (WS-GITOPS/WS-UPDATE) and live with apps/ — NOT here. (Contract: roadmap/workstreams.md
+# "Update policy contract".)
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImageUpdateAutomation
+metadata:
+  name: flux-image-automation
+  namespace: flux-system
+spec:
+  interval: 30m                 # the "schedule" on which stable versions are picked up (R-UPD-02)
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  git:
+    checkout:
+      ref:
+        branch: main            # TODO(WS-UPDATE): confirm write-back branch (may open PRs instead)
+    commit:
+      author:
+        name: fluxcdbot         # machine author — the auditable, intended write-back (ADR-0009)
+        email: [email protected]
+      messageTemplate: |
+        chore(images): automated update
+
+        Machine-authored image tag advance per ImagePolicy (R-UPD-02, ADR-0009).
+    push:
+      branch: main
+  update:
+    strategy: Setters           # image-automation setter markers in per-service manifests (apps/)
+    path: ./apps
+# TODO(WS-UPDATE, Phase 4): safety rails are acceptance gates (ADR-0009) — stable-only, health-gated
+#   rollout, auto-rollback on failed health, pin escape hatch, alert on update failure. Prove a test
+#   service auto-advances with no human/AI edit; a bad update auto-rolls-back + alerts (R-UPD-01/02/03).