phase2-prep: per-component no-secret rollout + component hardening (author-first)

Prep only — nothing deployed; running cluster untouched.

Reconciliation graph (operator-approved Option A): author clusters/dev/rollout/
= 4 per-component Flux Kustomizations (kyverno->cilium->longhorn->monitoring,
monitoring dependsOn longhorn). Dev overlay $patch:delete's the monolithic base
platform/apps and adds ./rollout, so only the no-secret tier reconciles; the
secret-blocked components are simply not created until hand-offs arrive. The
no-secret tier carries no SOPS content, so it needs no sops-age key. prod is
untouched (still builds the monolith). Convergence path coded in (delete rollout/
+ the two deletes) — R-ENV-02 divergence flagged for architect review.

Component hardening via cluster-vars (prod keeps strict posture):
- KYVERNO_VALIDATION_ACTION Enforce->Audit(dev), _WEBHOOK_FAILURE_POLICY
  Fail->Ignore(dev), _ADMISSION_REPLICAS 3->1(dev); webhook namespaceSelector
  excludes system+platform namespaces.
- MONITORING_STORAGE_CLASS var; GRAFANA_ADMIN_SECRET var (dev ''=chart default);
  Alertmanager SMTP/secret deferred to Phase-4 with verbatim re-enable markers.

Cilium parity verified against the live CNI (no-op adopt). Validated:
kubectl kustomize dev/prod/all-components, envsubst->YAML parse, make -C ci gate PASS.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

clusters/base/cluster-vars.yaml

@@ -27,6 +27,15 @@ data:
   MONITORING_PROMETHEUS_RETENTION: "7d"     # dev short | prod long
   MONITORING_PROMETHEUS_PVC_SIZE: "10Gi"
   MONITORING_LOKI_PVC_SIZE: "10Gi"
+  MONITORING_STORAGE_CLASS: "longhorn"      # PVC tier for Prometheus/Loki (dev may override)
+  GRAFANA_ADMIN_SECRET: "grafana-admin-credentials"  # by-name SOPS secret (prod); dev="" → chart default
+
+  # --- admission enforcement (Kyverno, ADR-0011). Base defaults are the STRICT/prod posture;
+  #     the dev overlay softens them for bootstrap (Audit / Ignore / 1) so a cold cluster can
+  #     come up before policies are proven and admission is HA. ---
+  KYVERNO_VALIDATION_ACTION: "Enforce"      # dev: Audit (observe before enforcing)
+  KYVERNO_WEBHOOK_FAILURE_POLICY: "Fail"    # dev: Ignore (fail-open during bootstrap)
+  KYVERNO_ADMISSION_REPLICAS: "3"           # dev: 1 (no HA needed to iterate)
 
   # --- identity / auth (ADR-0014) ---
   KEYCLOAK_REPLICAS: "1"                     # dev 1 | prod 2 (HA)