docs: reconcile docs/comments with post-upgrade cluster state

Text-only cleanup after the upgrade campaign. Updates stale version
strings, prose, and comments to the verified current facts; no
Kubernetes behavior or version pins changed except the kubectl
toolchain bump (below).

Verified facts applied: k3s v1.36.4+k3s1, Debian 13 trixie,
Cilium 1.20.1 / Gateway API v1.6.1, Longhorn 1.12.1, node RAM 24 GiB,
dedicated virtio2 SSD etcd disk per node, Velero chart 12.x / v1.18,
Grafana 13.2.0.

- Version strings across infra/ and platform/ READMEs + comments
- kubectl toolchain 1.31.4 -> 1.36.4 (devcontainer/ci/conformance
  versions.env; 1.31 vs a 1.36 cluster exceeded the +-1 skew)
- Retired-single-apps-Kustomization refs -> apps-wave-0/1/2 + apps-vms
  with per-wave SOPS decryption (flux/clusters docs + bootstrap.sh)
- COMPLETED/historical banners on the three executed plan docs
- Resolved TODO(WS-SEC) markers -> Renovate-maintained ranges
- Appended dated DECISIONS-LOG entry (2026-08-30) superseding the
  2026-08-26 LIVE STATE line

Left as revalidation items (not blind-edited): external-snapshotter
v8.2.0 vs 1.36, Cilium ext_authz/forward-auth relevance under 1.20.1,
conformance ImageVolume feature-gate assertions under 1.36.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

docs/plans/cluster-upgrade-plan.md

@@ -1,5 +1,12 @@
 # Cluster upgrade plan — k3s 1.31.5 → 1.36.x + node OS (dev cluster)
 
+> ## ✅ COMPLETED / historical — executed 2026-08-30, see git log
+>
+> **This plan has been carried out.** The dev cluster now runs **k3s v1.36.4+k3s1** on **Debian 13
+> (trixie)** with Cilium 1.20.1 and Longhorn 1.12.1. The steps, gates, and rollbacks below are
+> retained as the record of how the upgrade was performed — do NOT re-execute them against the live
+> cluster. Current state is tracked in `infra/PHASE1-STATUS.md` and the 2026-08-30 DECISIONS-LOG entry.
+
 **Scope:** the `home-network-k3s-impl` **dev** cluster (`k3s-dev-1/2/3` @ 192.168.1.50-52), 3× HA
 embedded-etcd servers behind a kube-vip VIP, Debian 12 bookworm. Upgrade Kubernetes/k3s from
 **v1.31.5+k3s1 → v1.36.x+k3s1** (five minors) and the node OS (Debian 12 → 13), with an

docs/plans/ssd-etcd-execution-runbook.md

@@ -1,5 +1,12 @@
 # Phase 2 execution runbook — SSD-backed etcd migration (interactive/manual)
 
+> ## ✅ COMPLETED / historical — executed 2026-08-30, see git log
+>
+> **This runbook has been executed.** Every k3s node's etcd now lives on its dedicated SSD `virtio2`
+> disk. The command sequence below is retained as the record of how the migration was performed — do
+> NOT re-run it against the live cluster. Current state is tracked in `infra/PHASE1-STATUS.md` and the
+> 2026-08-30 DECISIONS-LOG entry.
+
 Companion to `ssd-etcd-isolation.md`. This is the **exact command sequence** to migrate
 each k3s node's etcd onto its dedicated SSD `virtio2` disk. It must be run where live-infra
 mutations are permitted — an **interactive `claude` session** (default permission mode, which

docs/plans/ssd-etcd-isolation.md

@@ -1,5 +1,12 @@
 # SSD-backed etcd isolation for the k3s dev cluster
 
+> ## ✅ COMPLETED / historical — executed 2026-08-30, see git log
+>
+> **This proposal was approved and carried out.** Each node now has a dedicated `virtio2` SSD etcd
+> disk (`/dev/vdc`, `local-zfs`) hosting the etcd data dir. The **Status: PROPOSAL** line below and
+> the sizing/RAM figures are the original investigation record — retained for the reasoning, not as a
+> live to-do. Current state is tracked in `infra/PHASE1-STATUS.md` and the 2026-08-30 DECISIONS-LOG entry.
+
 **Status:** PROPOSAL — awaiting user approval. No changes have been made.
 **Author:** investigation agent (read-only), 2026-08-29
 **Problem:** Longhorn replica-rebuild I/O storms on the HDD-backed VM disks starve