docs: reconcile docs/comments with post-upgrade cluster state

Text-only cleanup after the upgrade campaign. Updates stale version
strings, prose, and comments to the verified current facts; no
Kubernetes behavior or version pins changed except the kubectl
toolchain bump (below).

Verified facts applied: k3s v1.36.4+k3s1, Debian 13 trixie,
Cilium 1.20.1 / Gateway API v1.6.1, Longhorn 1.12.1, node RAM 24 GiB,
dedicated virtio2 SSD etcd disk per node, Velero chart 12.x / v1.18,
Grafana 13.2.0.

- Version strings across infra/ and platform/ READMEs + comments
- kubectl toolchain 1.31.4 -> 1.36.4 (devcontainer/ci/conformance
  versions.env; 1.31 vs a 1.36 cluster exceeded the +-1 skew)
- Retired-single-apps-Kustomization refs -> apps-wave-0/1/2 + apps-vms
  with per-wave SOPS decryption (flux/clusters docs + bootstrap.sh)
- COMPLETED/historical banners on the three executed plan docs
- Resolved TODO(WS-SEC) markers -> Renovate-maintained ranges
- Appended dated DECISIONS-LOG entry (2026-08-30) superseding the
  2026-08-26 LIVE STATE line

Left as revalidation items (not blind-edited): external-snapshotter
v8.2.0 vs 1.36, Cilium ext_authz/forward-auth relevance under 1.20.1,
conformance ImageVolume feature-gate assertions under 1.36.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

DECISIONS-LOG.md

@@ -1150,3 +1150,27 @@ gitignored (agent worktrees were tripping the lint stage's untracked-file scan).
    Plex uses `/config` → Plex writes the ephemeral layer, is unclaimed, loses config on restart
    (seerr↔plex connectivity is actually fine — 200 on `/identity`). FIX PENDING operator go (resets
    Plex, needs re-claim): mount PVC at `/config` + wire `PLEX_CLAIM`.
+
+---
+
+## 2026-08-30 — Upgrade campaign landed: cluster now k3s v1.36.4 / Debian 13 / Cilium 1.20.1 / Longhorn 1.12.1
+
+The platform-wide upgrade campaign completed and is live. Verified current state of the dev cluster:
+
+- **k3s v1.36.4+k3s1** (was v1.31.5+k3s1), 3-server embedded-etcd HA.
+- **Debian 13 (trixie)** node OS (was Debian 12 bookworm).
+- **Cilium 1.20.1** (was 1.16.5); **Gateway API v1.6.1** (was v1.2.x).
+- **Longhorn 1.12.1** (was 1.7.3).
+- cert-manager >=1.21; Velero chart 12.x / Velero v1.18; kube-prometheus-stack 88 (operator
+  v0.93.1, Grafana 13.2.0); kube-vip v1.2.3.
+- Node RAM **24 GiB / 24576 MB** (tofu default; earlier docs said 16 GiB).
+- Each node now carries a **dedicated virtio2 SSD etcd disk** (`/dev/vdc`, `local-zfs`) isolating
+  etcd WAL fsync from HDD Longhorn I/O — see `docs/plans/ssd-etcd-isolation.md`.
+
+**The "LIVE STATE VERIFIED 2026-08-26" line above (k3s v1.31.5) is SUPERSEDED by this entry.**
+That older line is retained as historical record — this append is the current source of truth.
+Documentation and comments across the repo were reconciled to these facts in the same change;
+toolchain kubectl bumped 1.31.4 → 1.36.4 (the 1.31 pin exceeded the ±1 version skew against a 1.36
+cluster). Revalidation items deliberately left open: external-snapshotter v8.2.0 pin vs 1.36, the
+Cilium ext_authz/forward-auth workaround relevance under 1.20.1, and the conformance ImageVolume
+feature-gate assertions under 1.36.