docs: reconcile docs/comments with post-upgrade cluster state

Text-only cleanup after the upgrade campaign. Updates stale version
strings, prose, and comments to the verified current facts; no
Kubernetes behavior or version pins changed except the kubectl
toolchain bump (below).

Verified facts applied: k3s v1.36.4+k3s1, Debian 13 trixie,
Cilium 1.20.1 / Gateway API v1.6.1, Longhorn 1.12.1, node RAM 24 GiB,
dedicated virtio2 SSD etcd disk per node, Velero chart 12.x / v1.18,
Grafana 13.2.0.

- Version strings across infra/ and platform/ READMEs + comments
- kubectl toolchain 1.31.4 -> 1.36.4 (devcontainer/ci/conformance
  versions.env; 1.31 vs a 1.36 cluster exceeded the +-1 skew)
- Retired-single-apps-Kustomization refs -> apps-wave-0/1/2 + apps-vms
  with per-wave SOPS decryption (flux/clusters docs + bootstrap.sh)
- COMPLETED/historical banners on the three executed plan docs
- Resolved TODO(WS-SEC) markers -> Renovate-maintained ranges
- Appended dated DECISIONS-LOG entry (2026-08-30) superseding the
  2026-08-26 LIVE STATE line

Left as revalidation items (not blind-edited): external-snapshotter
v8.2.0 vs 1.36, Cilium ext_authz/forward-auth relevance under 1.20.1,
conformance ImageVolume feature-gate assertions under 1.36.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

bootstrap/flux/README.md

@@ -13,14 +13,16 @@ Spec: [ADR-0004 (Flux)](../../../home-network-k3s/decisions/adr-0004-gitops-flux
 |---|---|
 | `bootstrap.sh` | **The single bootstrap entrypoint** the Infra worker's final Ansible play calls. `flux install` → verify `sops-age` Secret → `kubectl apply -k clusters/dev`. |
 | `patches/platform-sops-decryption.yaml` | Strategic-merge patch enabling `decryption.provider: sops` + `secretRef: sops-age` on the `platform` Kustomization (realises the base TODO). |
-| `patches/apps-sops-decryption.yaml` | Same, for the `apps` Kustomization. |
+| `patches/apps-sops-decryption.yaml` | Same, for the app-wave Kustomizations. There is **no single `apps` Kustomization** any more — the apps tier is now `apps-wave-0/1/2` + `apps-vms`, and SOPS decryption is layered on **per wave** (each wave Kustomization is patched by name in `clusters/dev`). |
 | `patches/flux-system-source-url.yaml` | Overrides the `flux-system` GitRepository `url` placeholder with the real bootstrap source (template — fill at bootstrap). |
 
 ## Why `flux install` + apply, not `flux bootstrap git` (Phase 1)
 
 The reconciliation graph is **already authored** in `clusters/base` (read-only to this worker):
-`flux-system.yaml` is the `flux-system` **GitRepository**; `platform.yaml`/`apps.yaml` are the Flux
-**Kustomizations**; `clusters/dev` is the overlay that patches `cluster-vars` (R-ENV-02).
+`flux-system.yaml` is the `flux-system` **GitRepository**; `platform.yaml`, `platform-config.yaml`
+and the app-wave Kustomizations (`apps-wave-0/1/2.yaml` + `apps-vms.yaml` — the single `apps.yaml`
+was retired) are the Flux **Kustomizations**; `clusters/dev` is the overlay that patches
+`cluster-vars` (R-ENV-02) and layers SOPS decryption onto each Kustomization by name.
 
 `flux bootstrap git` **generates and owns its own** `gotk-sync` GitRepository + Kustomization named
 `flux-system` and commits them into the repo — which would **duplicate/conflict** with the authored
@@ -41,8 +43,9 @@ tofu apply → cloud-init → Ansible (k3s + Cilium)          [Infra worker, T-1
 3. bootstrap/flux/bootstrap.sh           # flux install → verify sops-age → apply -k clusters/dev
         │
         ▼
-Flux reconciles: GitRepository(flux-system) → Kustomization(platform) → Kustomization(apps),
-with SOPS decryption enabled (patches/) and cluster-vars overlay (R-ENV-02).
+Flux reconciles: GitRepository(flux-system) → Kustomization(platform) → Kustomization(platform-config)
+→ Kustomization(apps-wave-0 → apps-wave-1 → apps-wave-2) + Kustomization(apps-vms),
+with per-Kustomization SOPS decryption enabled (patches/) and cluster-vars overlay (R-ENV-02).
 ```
 
 ## Interface note — for the Infra worker (T-1.3 Ansible)
@@ -72,7 +75,8 @@ patches:
   - path: ../../bootstrap/flux/patches/apps-sops-decryption.yaml      # SOPS on apps
 ```
 
-Alternatively the base TODOs in `clusters/base/{platform,apps}.yaml` and the `url` in
+Alternatively the base TODOs in `clusters/base/platform.yaml` and each app-wave Kustomization
+(`apps-wave-0/1/2.yaml`, `apps-vms.yaml`) and the `url` in
 `clusters/base/flux-system.yaml` can be filled in directly (same effect) — the clusters owner's call.
 Either way the `sops-age` `secretRef` name and `flux-system` source name are kept in lockstep with
 the authored base.

bootstrap/flux/bootstrap.sh

@@ -25,7 +25,9 @@
 #                         We do NOT use `flux bootstrap git` in Phase 1 because that command commits
 #                         and OWNS its own gotk-sync GitRepository+Kustomization named `flux-system`.
 #                         Our entrypoints are ALREADY authored in clusters/base (flux-system.yaml =
-#                         the GitRepository; platform.yaml/apps.yaml = the Kustomizations). Letting
+#                         the GitRepository; platform.yaml + platform-config.yaml + the app-wave
+#                         Kustomizations apps-wave-0/1/2.yaml + apps-vms.yaml = the Kustomizations;
+#                         the single apps.yaml was retired). Letting
 #                         bootstrap regenerate them would DUPLICATE/conflict. `flux install` +
 #                         applying the authored clusters/dev overlay is the reconciling path.
 #   2. sops-age Secret  — the operator installs the age PRIVATE key out-of-band BEFORE reconcile so
@@ -33,8 +35,9 @@
 #                         only VERIFIES it exists; it never handles key material.
 #   3. `kubectl apply -k clusters/dev` — materialises the authored reconciliation graph:
 #                         GitRepository `flux-system` (source) -> Kustomization `platform` ->
-#                         Kustomization `apps` (dependsOn platform), with cluster-vars overlay
-#                         (R-ENV-02) and SOPS decryption enabled via the patches in ./patches/.
+#                         `platform-config` -> the app-wave Kustomizations `apps-wave-0/1/2`
+#                         (chained dependsOn) + `apps-vms`, with cluster-vars overlay
+#                         (R-ENV-02) and per-Kustomization SOPS decryption enabled via ./patches/.
 #
 # PREREQUISITES the operator/PM resolves before this runs (see ../README.md "Handoff"):
 #   - clusters/base/flux-system.yaml url placeholder is overridden — wire ./patches/flux-system-