T-0.1 Flux GitOps layout + dev/prod overlays + platform component skeletons (R-GITOPS-01/03, R-ENV-02, R-PLAT-01)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/kubevirt/README.md

@@ -0,0 +1,31 @@
+# platform/kubevirt
+
+**KubeVirt + CDI** — run application VMs (IaaS) as Kubernetes resources on the same control plane,
+network, storage, and GitOps flow as containers.
+
+- **Governing ADR:** [ADR-0005 — VM workloads: KubeVirt + CDI](../../../home-network-k3s/decisions/adr-0005-vm-workloads-kubevirt.md)
+- **Spec:** [docs/06 — VM Workloads (KubeVirt)](../../../home-network-k3s/docs/06-vm-workloads-kubevirt.md)
+- **Serves:** R-PLAT-03/04, R-STATE-01
+- **Owner:** WS-VM
+
+## What this stub is
+
+A Kustomization that will pull the pinned **KubeVirt operator** + **CDI operator** release manifests
+(commented TODO — added in Phase 5), plus the **`KubeVirt`** and **`CDI`** custom resources that tune
+them. VM disks land on **Longhorn** PVCs via CDI; VMs inherit Cilium default-deny + egress classes.
+
+> **Layer distinction (docs/01):** these are **Layer-2 application VMs** (a feature the platform
+> offers), NOT the Layer-1 cluster-node VMs (which WS-INFRA provisions with OpenTofu/libvirt). Do not
+> conflate them.
+
+## Cross-workstream prerequisite
+
+Nodes must expose **virtualization extensions** (nested virt in dev KVMs; native on prod) — a node
+baseline prerequisite owned by **WS-INFRA** (docs/02). Coordinate before Phase 5.
+
+## TODO (later phases — Phase 5, gated on Phases 2–3)
+
+- Add pinned operator release manifests as Kustomize bases; let Renovate maintain versions.
+- Run one representative application VM via a ServiceDefinition `kind: vm`; prove create/start/stop/
+  destroy via `kubectl`/`virtctl`, Longhorn-backed disk survives rebuild, default-deny + egress apply,
+  guest auto-updates (Phase-5 exit gates).