Autonomous session: Phase-2 platform authoring + Flux bootstrap progress

Author-only Phase-2 components (platform suspended; cluster untouched):
- platform/longhorn: 3-replica SC + bulk external-mount indirection (R-STATE)
- platform/monitoring: kube-prometheus-stack + Loki + Alloy (dev-trimmed) + 8 alert rules (R-OBS)
- platform/cilium: parity fix (k8sServiceHost=10.73.0.11 + masquerade) safe to adopt Phase 2
- conformance: partial L2 tests (worker hit session limit; incomplete — see DECISIONS-LOG K2)
- bootstrap/gitea: fix rootless-podman perms (host bind-mount -> named volume)

Flux installed on the cluster; host Gitea up + repo pushed; GitRepository BLOCKED by
host firewalld (VM->10.73.0.1:3000) — needs one operator sudo command (DECISIONS-LOG).
Known issue K1: cluster-vars substitution-var case mismatch (fix before un-suspend).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/longhorn/values.yaml

@@ -1,7 +1,21 @@
-# Longhorn Helm values — PLACEHOLDER (Phase 0). Authoritative values inline in helmrelease.yaml.
+# Longhorn Helm values — REFERENCE ONLY (not consumed by kustomization.yaml).
 #
-# persistence.defaultClass: false                 # we own StorageClasses (storageclasses.yaml)
-# persistence.defaultClassReplicaCount: ${LONGHORN_DEFAULT_REPLICA_COUNT}   # overlay knob
-# defaultSettings.defaultDataPath: <data disk>    # TODO(WS-STORAGE): dedicated Longhorn disk (docs/02)
-# defaultSettings.backupTarget: <off-cluster>     # TODO(WS-STORAGE, Phase 4): DR target (ADR-0003)
-# Longhorn UI exposure gated behind oauth2-proxy forward-auth (ADR-0014).
+# The authoritative values are inline in helmrelease.yaml (matching the sibling pattern across
+# platform/ — cilium, cert-manager, velero, etc.). This file documents the knobs that matter so a
+# reviewer can see intent without reading the HelmRelease. Keep it in sync with helmrelease.yaml.
+#
+# persistence:
+#   defaultClass: false                              # we own StorageClasses (storageclasses.yaml)
+#
+# defaultSettings:
+#   defaultDataPath: /var/lib/longhorn               # dedicated data disk (infra/cloud-init)
+#   defaultReplicaCount: ${LONGHORN_DEFAULT_REPLICA_COUNT}   # overlay knob (=3 in dev)
+#   replicaSoftAntiAffinity: false                   # HARD anti-affinity: one replica per node
+#   replicaZoneSoftAntiAffinity: true                # single zone (3 mini-PCs, no failure zones)
+#   replicaAutoBalance: best-effort                  # rebalance toward one-per-node when a node returns
+#   storageReservedPercentageForDefaultDisk: "20"    # reserve disk headroom (docs/04 guardrail)
+#   storageMinimalAvailablePercentage: "25"          # stop scheduling below 25% free
+#   storageOverProvisioningPercentage: "100"         # dev: no thin over-provisioning (1:1)
+#   defaultDataLocality: disabled                    # keep replicas spread for durability
+#   orphanAutoDeletion: true                         # reclaim orphaned replica space promptly
+#   backupTarget: <off-cluster>                      # TODO(WS-STORAGE, Phase 4): DR target (ADR-0003)