Phase 5: KubeVirt + CDI IaaS proof (R-PLAT-03/04, R-STATE-01, R-NET-01)

- platform/kubevirt: pinned KubeVirt v1.9.0 + CDI v1.66.0 operators (remote bases);
  KubeVirt/CDI CRs tuned for Longhorn; useEmulation=true (prefer real KVM, emulate fallback).
- Controllers/configs split (F-MON1): CRs + ServiceMonitors + alerts via platform-config.
- Observability: ServiceMonitors, KubeVirt platform-health alerts (R-OBS-04), VM dashboard.
- catalog/vm-demo.yaml (kind: vm) + rendered VirtualMachine/DataVolume fixture.
- Conformance: vm-lifecycle (R-PLAT-03/04), vm-data-survival (R-STATE-01, L3),
  vm-default-deny (R-NET-01) — self-skipping until KubeVirt+longhorn exist.
- ci/SPEC_PIN: adopt accepted spec b633b7f (ADR-0015 egress work already merged).
- conformance/run.sh: document R-ENV-02/R-GITOPS-01 coverage gaps (WS-GITOPS/INFRA-owned).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/kubevirt/servicemonitor.yaml

@@ -0,0 +1,53 @@
+---
+# ServiceMonitors so the platform Prometheus (kube-prometheus-stack, monitoring ns) scrapes the
+# KubeVirt + CDI control-plane metrics (docs/10 — "KubeVirt: VM crash-loops / failed launches" is a
+# first-class platform-health signal). These are CRs of the monitoring.coreos.com CRD installed by the
+# kube-prometheus-stack HelmRelease, so — like platform/monitoring/alerts.yaml — they are applied by
+# the `platform-config` Flux Kustomization (dependsOn: platform), NOT in the controllers pass (F-MON1).
+#
+# Prometheus discovers ServiceMonitors cluster-wide (serviceMonitorSelectorNilUsesHelmValues:false in
+# platform/monitoring/kube-prometheus-stack.yaml), so these can live beside their target Services.
+# NOTE (verify at bring-up, same convention as alerts.yaml): KubeVirt serves metrics over HTTPS with a
+# self-signed internal cert (insecureSkipVerify) on the port named `metrics`; CDI serves plain HTTP on
+# its `metrics` port. Port names/scheme are confirmed against the deployed Services on first reconcile.
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: kubevirt
+  namespace: kubevirt
+  labels:
+    release: kube-prometheus-stack
+spec:
+  selector:
+    matchLabels:
+      prometheus.kubevirt.io: "true"
+  namespaceSelector:
+    matchNames:
+      - kubevirt
+  endpoints:
+    - port: metrics
+      scheme: https
+      tlsConfig:
+        insecureSkipVerify: true
+      honorLabels: true
+      interval: 30s
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: cdi
+  namespace: cdi
+  labels:
+    release: kube-prometheus-stack
+spec:
+  selector:
+    matchLabels:
+      prometheus.cdi.kubevirt.io: "true"
+  namespaceSelector:
+    matchNames:
+      - cdi
+  endpoints:
+    - port: metrics
+      scheme: http
+      honorLabels: true
+      interval: 30s