docs: reconcile docs/comments with post-upgrade cluster state

Text-only cleanup after the upgrade campaign. Updates stale version
strings, prose, and comments to the verified current facts; no
Kubernetes behavior or version pins changed except the kubectl
toolchain bump (below).

Verified facts applied: k3s v1.36.4+k3s1, Debian 13 trixie,
Cilium 1.20.1 / Gateway API v1.6.1, Longhorn 1.12.1, node RAM 24 GiB,
dedicated virtio2 SSD etcd disk per node, Velero chart 12.x / v1.18,
Grafana 13.2.0.

- Version strings across infra/ and platform/ READMEs + comments
- kubectl toolchain 1.31.4 -> 1.36.4 (devcontainer/ci/conformance
  versions.env; 1.31 vs a 1.36 cluster exceeded the +-1 skew)
- Retired-single-apps-Kustomization refs -> apps-wave-0/1/2 + apps-vms
  with per-wave SOPS decryption (flux/clusters docs + bootstrap.sh)
- COMPLETED/historical banners on the three executed plan docs
- Resolved TODO(WS-SEC) markers -> Renovate-maintained ranges
- Appended dated DECISIONS-LOG entry (2026-08-30) superseding the
  2026-08-26 LIVE STATE line

Left as revalidation items (not blind-edited): external-snapshotter
v8.2.0 vs 1.36, Cilium ext_authz/forward-auth relevance under 1.20.1,
conformance ImageVolume feature-gate assertions under 1.36.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

infra/ansible/roles/cilium/defaults/main.yml

@@ -4,14 +4,15 @@
 # HelmRelease adopts config afterward. The parity-critical values
 # (kubeProxyReplacement, k8sServiceHost/Port) are templated from k3s_api_host.
 
-# Pin inside the platform/cilium HelmRelease window (>=1.16.0 <1.17.0).
+# Exact pin — MUST equal the platform/cilium HelmRelease chart.spec.version (1.20.1, an
+# exact pin, not a range). Renovate bumps both together.
 cilium_version: "1.20.1"
 cilium_chart_repo_name: "cilium"
 cilium_chart_repo_url: "https://helm.cilium.io/"
 cilium_namespace: "kube-system"
 
 # Gateway API CRDs (standard channel) must exist BEFORE Cilium with gatewayAPI.enabled.
-# Cilium 1.16 targets Gateway API v1.2.x.
+# Cilium 1.20.1 targets Gateway API v1.6.1.
 gateway_api_version: "v1.6.1"
 gateway_api_crd_urls:
   - "https://github.com/kubernetes-sigs/gateway-api/releases/download/{{ gateway_api_version }}/standard-install.yaml"

infra/ansible/roles/k3s_server/defaults/main.yml

@@ -1,7 +1,7 @@
 ---
 # k3s_server role defaults (ADR-0001).
 
-# Best-effort version pin (kept near the ci/versions kubectl 1.31.x line). Bump
+# Best-effort version pin (kept near the ci/versions kubectl 1.36.x line). Bump
 # deliberately — a version change is a code change. Empty string => latest stable.
 k3s_version: "v1.36.4+k3s1"