Phase 5: KubeVirt + CDI IaaS proof (R-PLAT-03/04, R-STATE-01, R-NET-01)

- platform/kubevirt: pinned KubeVirt v1.9.0 + CDI v1.66.0 operators (remote bases);
  KubeVirt/CDI CRs tuned for Longhorn; useEmulation=true (prefer real KVM, emulate fallback).
- Controllers/configs split (F-MON1): CRs + ServiceMonitors + alerts via platform-config.
- Observability: ServiceMonitors, KubeVirt platform-health alerts (R-OBS-04), VM dashboard.
- catalog/vm-demo.yaml (kind: vm) + rendered VirtualMachine/DataVolume fixture.
- Conformance: vm-lifecycle (R-PLAT-03/04), vm-data-survival (R-STATE-01, L3),
  vm-default-deny (R-NET-01) — self-skipping until KubeVirt+longhorn exist.
- ci/SPEC_PIN: adopt accepted spec b633b7f (ADR-0015 egress work already merged).
- conformance/run.sh: document R-ENV-02/R-GITOPS-01 coverage gaps (WS-GITOPS/INFRA-owned).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform-config/kustomization.yaml

@@ -31,3 +31,12 @@ resources:
   - cilium/l2-announcement-policy.yaml
   # monitoring: PrometheusRule alert rules (need monitoring.coreos.com CRDs from kube-prometheus-stack)
   - ../platform/monitoring/alerts.yaml
+  # kubevirt/cdi (Phase 5): the KubeVirt + CDI CRs consume the kubevirt.io / cdi.kubevirt.io CRDs the
+  # operators register; the ServiceMonitors/alerts consume monitoring.coreos.com. All CRs of platform-
+  # installed CRDs -> applied here, gated dependsOn platform (F-MON1). The dashboard is a plain
+  # ConfigMap kept beside them for locality.
+  - ../platform/kubevirt/kubevirt-cr.yaml
+  - ../platform/kubevirt/cdi-cr.yaml
+  - ../platform/kubevirt/servicemonitor.yaml
+  - ../platform/kubevirt/alerts.yaml
+  - ../platform/kubevirt/dashboard.yaml