docs: reconcile docs/comments with post-upgrade cluster state

Text-only cleanup after the upgrade campaign. Updates stale version
strings, prose, and comments to the verified current facts; no
Kubernetes behavior or version pins changed except the kubectl
toolchain bump (below).

Verified facts applied: k3s v1.36.4+k3s1, Debian 13 trixie,
Cilium 1.20.1 / Gateway API v1.6.1, Longhorn 1.12.1, node RAM 24 GiB,
dedicated virtio2 SSD etcd disk per node, Velero chart 12.x / v1.18,
Grafana 13.2.0.

- Version strings across infra/ and platform/ READMEs + comments
- kubectl toolchain 1.31.4 -> 1.36.4 (devcontainer/ci/conformance
  versions.env; 1.31 vs a 1.36 cluster exceeded the +-1 skew)
- Retired-single-apps-Kustomization refs -> apps-wave-0/1/2 + apps-vms
  with per-wave SOPS decryption (flux/clusters docs + bootstrap.sh)
- COMPLETED/historical banners on the three executed plan docs
- Resolved TODO(WS-SEC) markers -> Renovate-maintained ranges
- Appended dated DECISIONS-LOG entry (2026-08-30) superseding the
  2026-08-26 LIVE STATE line

Left as revalidation items (not blind-edited): external-snapshotter
v8.2.0 vs 1.36, Cilium ext_authz/forward-auth relevance under 1.20.1,
conformance ImageVolume feature-gate assertions under 1.36.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/cert-manager/helmrelease.yaml

@@ -10,7 +10,7 @@ spec:
   chart:
     spec:
       chart: cert-manager
-      version: ">=1.21.0 <1.22.0"   # TODO(WS-SEC): pin at bring-up; Renovate maintains
+      version: ">=1.21.0 <1.22.0"   # Renovate-maintained range (bring-up is past; team uses ranges, not exact pins)
       sourceRef:
         kind: HelmRepository
         name: jetstack

platform/cilium/values.yaml

@@ -6,9 +6,9 @@
 #
 # SOURCE OF TRUTH (all [parity] fields MUST equal these):
 #   infra/ansible/roles/cilium/templates/cilium-values.yaml.j2
-#   infra/ansible/roles/cilium/defaults/main.yml   (cilium_version: 1.16.5, k3s_api_host/port)
+#   infra/ansible/roles/cilium/defaults/main.yml   (cilium_version: 1.20.1, k3s_api_host/port)
 #
-# chart version (helmrelease.yaml chart.spec.version): 1.16.5   # [parity] = cilium_version
+# chart version (helmrelease.yaml chart.spec.version): 1.20.1   # [parity] = cilium_version
 
 # [parity] k3s kube-proxy disabled → Cilium replaces it (ADR-0001/0002)
 kubeProxyReplacement: true

platform/cnpg/helmrelease.yaml

@@ -13,7 +13,7 @@ spec:
   chart:
     spec:
       chart: cloudnative-pg
-      version: ">=0.22.0 <1.0.0"   # TODO(WS-SEC): pin at bring-up; Renovate maintains
+      version: ">=0.22.0 <1.0.0"   # Renovate-maintained range (bring-up is past; team uses ranges, not exact pins)
       sourceRef:
         kind: HelmRepository
         name: cloudnative-pg

platform/external-snapshotter/README.md

@@ -26,6 +26,7 @@ Neither k3s nor the Longhorn chart ships this. It is a prerequisite for:
 ## Version
 
 Pinned to **v8.2.0** (Renovate-maintained). The v8.x line aligned to Kubernetes 1.31 at
-v8.1.0; this cluster is k3s v1.31.5. The snapshot-controller image is re-pinned to the same
-tag via the kustomization `images` transformer (the upstream setup manifest lags on the image
-tag).
+v8.1.0; this cluster is now k3s v1.36.4, so the pin should be **re-checked for 1.36** (a newer
+external-snapshotter line may be the version-matched choice) — do not treat v8.2.0 as verified
+against 1.36 yet. The snapshot-controller image is re-pinned to the same tag via the kustomization
+`images` transformer (the upstream setup manifest lags on the image tag).

platform/external-snapshotter/kustomization.yaml

@@ -18,9 +18,10 @@
 # CRDs (the Longhorn VolumeSnapshotClass, item 2) live in platform-config so the CRDs exist first.
 #
 # VERSION (Renovate-maintained): external-snapshotter v8.2.0.
-#   * The v8.x line updated its Kubernetes deps to 1.31 at v8.1.0 (this cluster is k3s v1.31.5),
-#     so v8.2.x is the conservative, version-matched choice — newer than the 1.31 alignment,
-#     older than the v8.4/v8.5 churn.
+#   * The v8.x line updated its Kubernetes deps to 1.31 at v8.1.0. This cluster is now k3s v1.36.4,
+#     so the v8.2.0 pin is NO LONGER verified against the running Kubernetes version — RE-CHECK it
+#     for 1.36 (a newer external-snapshotter line may be the version-matched choice). Pin left as-is
+#     pending that revalidation.
 #   * snapshot.storage.k8s.io CRDs are served at v1 (GA) — driver.longhorn.io speaks v1, so
 #     Longhorn CSI snapshots + CDI snapshot-clone work against these CRDs.
 #   * The upstream setup manifest pins the controller image to an older v8.0.x tag; the `images`

platform/longhorn/README.md

@@ -63,7 +63,7 @@ media on the replicated tier, or app DBs on the bulk tier.**
 - **OQ-2 (human):** decide the `bulk`-tier backing (NAS/NFS host + share, vs dedicated large disk).
   Until answered, the `bulk` class is a non-functional placeholder (`server`/`share` = REPLACE-ME).
   Blocks `bulk` finalize; does **not** block the core platform (docs/04).
-- **Version pin (WS-STORAGE):** `>=1.7.0 <1.8.0` is a range; pin exactly at bring-up, Renovate
+- **Version pin (WS-STORAGE):** `>=1.12.0 <1.13.0` is a range; pin exactly at bring-up, Renovate
   maintains.
 - **Phase 4 (WS-STORAGE):** off-cluster backup target via `defaultSettings.backupTarget` +
   SOPS-encrypted credential secret, wired alongside `platform/velero/` (R-STATE-03).

platform/monitoring/kube-prometheus-stack.yaml

@@ -172,9 +172,9 @@ spec:
       resources:
         requests:
           cpu: 50m
-          memory: 256Mi                     # Grafana 12.x (kps 88) baseline is well above Grafana 11.x (kps 65)
+          memory: 256Mi                     # Grafana 13.x (image 13.2.0, kps 88) baseline is well above Grafana 11.x (kps 65)
         limits:
-          memory: 512Mi                      # 256Mi OOMKilled (exit 137) Grafana 12.x during apiserver/unified-storage
+          memory: 512Mi                      # 256Mi OOMKilled (exit 137) Grafana 13.x during apiserver/unified-storage
                                              # startup — the silent SIGKILL that made the whole 65->88 Helm upgrade
                                              # time out (the new Grafana pod never went Ready). 512Mi holds.
       # --- Keycloak native-OIDC SSO (ADR-0014, deliverable #4 SSO proof) ---

platform/velero/README.md

@@ -9,7 +9,7 @@
 
 ## What this is (LIVE)
 
-Flux `HelmRelease` (Velero chart 8.x / Velero 1.15.x) wired to the on-Proxmox **MinIO** S3 target:
+Flux `HelmRelease` (Velero chart 12.x / Velero 1.18.x) wired to the on-Proxmox **MinIO** S3 target:
 
 - **Endpoint:** `http://192.168.1.9:9000` (plain HTTP, **path-style**, region `us-east-1` placeholder)
 - **BucketStorageLocation `default`:** provider `aws`, bucket `velero`, `s3ForcePathStyle=true`.