Phase 5: KubeVirt + CDI IaaS proof (R-PLAT-03/04, R-STATE-01, R-NET-01)

- platform/kubevirt: pinned KubeVirt v1.9.0 + CDI v1.66.0 operators (remote bases);
  KubeVirt/CDI CRs tuned for Longhorn; useEmulation=true (prefer real KVM, emulate fallback).
- Controllers/configs split (F-MON1): CRs + ServiceMonitors + alerts via platform-config.
- Observability: ServiceMonitors, KubeVirt platform-health alerts (R-OBS-04), VM dashboard.
- catalog/vm-demo.yaml (kind: vm) + rendered VirtualMachine/DataVolume fixture.
- Conformance: vm-lifecycle (R-PLAT-03/04), vm-data-survival (R-STATE-01, L3),
  vm-default-deny (R-NET-01) — self-skipping until KubeVirt+longhorn exist.
- ci/SPEC_PIN: adopt accepted spec b633b7f (ADR-0015 egress work already merged).
- conformance/run.sh: document R-ENV-02/R-GITOPS-01 coverage gaps (WS-GITOPS/INFRA-owned).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/kubevirt/cdi-cr.yaml

@@ -1,11 +1,27 @@
 ---
-# CDI CR — Containerized Data Importer, provisions VM disks onto Longhorn PVCs (ADR-0005).
-# Phase 0 STUB; requires the CDI operator (added in Phase 5).
+# CDI CR — Containerized Data Importer, provisions/imports VM disks onto Longhorn PVCs (ADR-0005).
+# CONSUMES the cdi.kubevirt.io CRD registered by the CDI operator, so — like the KubeVirt CR — it is
+# applied by the `platform-config` Flux Kustomization (dependsOn: platform), not in the controllers
+# pass (F-MON1). VM disks then get the same 3-replica Longhorn durability + backup story as container
+# volumes (docs/04).
 apiVersion: cdi.kubevirt.io/v1beta1
 kind: CDI
 metadata:
   name: cdi
   namespace: cdi
+  annotations:
+    homelab.keithjackson.dev/adr: ADR-0005
 spec:
-  # TODO(WS-VM, Phase 5): scratch space storageClass (longhorn), upload/import proxy settings.
-  config: {}
+  # ImagePullPolicy for CDI's own importer/uploader images.
+  imagePullPolicy: IfNotPresent
+  infra: {}
+  workload: {}
+  config:
+    # CDI's transient scratch space (used while converting/decompressing an imported image) is carved
+    # from the replicated Longhorn tier — the same StorageClass the final VM DataVolumes bind to, so
+    # there is no second storage tier to reason about. (docs/04, ADR-0003.)
+    scratchSpaceStorageClass: longhorn
+    # Reserve headroom on the filesystem-mode PVC for qcow2 metadata so an import never wedges a volume
+    # at 100%. 0.055 is CDI's documented default; pinned here so it is explicit and reviewable.
+    filesystemOverhead:
+      global: "0.055"