docs: reconcile docs/comments with post-upgrade cluster state

Text-only cleanup after the upgrade campaign. Updates stale version
strings, prose, and comments to the verified current facts; no
Kubernetes behavior or version pins changed except the kubectl
toolchain bump (below).

Verified facts applied: k3s v1.36.4+k3s1, Debian 13 trixie,
Cilium 1.20.1 / Gateway API v1.6.1, Longhorn 1.12.1, node RAM 24 GiB,
dedicated virtio2 SSD etcd disk per node, Velero chart 12.x / v1.18,
Grafana 13.2.0.

- Version strings across infra/ and platform/ READMEs + comments
- kubectl toolchain 1.31.4 -> 1.36.4 (devcontainer/ci/conformance
  versions.env; 1.31 vs a 1.36 cluster exceeded the +-1 skew)
- Retired-single-apps-Kustomization refs -> apps-wave-0/1/2 + apps-vms
  with per-wave SOPS decryption (flux/clusters docs + bootstrap.sh)
- COMPLETED/historical banners on the three executed plan docs
- Resolved TODO(WS-SEC) markers -> Renovate-maintained ranges
- Appended dated DECISIONS-LOG entry (2026-08-30) superseding the
  2026-08-26 LIVE STATE line

Left as revalidation items (not blind-edited): external-snapshotter
v8.2.0 vs 1.36, Cilium ext_authz/forward-auth relevance under 1.20.1,
conformance ImageVolume feature-gate assertions under 1.36.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/monitoring/kube-prometheus-stack.yaml

@@ -172,9 +172,9 @@ spec:
       resources:
         requests:
           cpu: 50m
-          memory: 256Mi                     # Grafana 12.x (kps 88) baseline is well above Grafana 11.x (kps 65)
+          memory: 256Mi                     # Grafana 13.x (image 13.2.0, kps 88) baseline is well above Grafana 11.x (kps 65)
         limits:
-          memory: 512Mi                      # 256Mi OOMKilled (exit 137) Grafana 12.x during apiserver/unified-storage
+          memory: 512Mi                      # 256Mi OOMKilled (exit 137) Grafana 13.x during apiserver/unified-storage
                                              # startup — the silent SIGKILL that made the whole 65->88 Helm upgrade
                                              # time out (the new Grafana pod never went Ready). 512Mi holds.
       # --- Keycloak native-OIDC SSO (ADR-0014, deliverable #4 SSO proof) ---