platform: move Headlamp out of the gating platform tier + fix -session-ttl crashloop

Headlamp's HelmRelease sat in the wait:true `platform` Flux tier. Its pod
crashlooped (`flag provided but not defined: -session-ttl` — chart 0.40.1
renders a container arg the appVersion v0.40.1 backend lacks; upstream
kubernetes-sigs/headlamp#4883), and because it gated `platform`, the whole
chain stalled: platform Ready=Unknown -> platform-config, oauth2-proxy,
apps-wave-0/1/2 and apps-vms all Ready=False "dependency not ready".

Part A (unblock + durable lesson): a leaf UI must never gate the chain. Move
all Headlamp resources into a new non-gating Flux Kustomization
clusters/base/headlamp.yaml (dependsOn platform-config, wait:false, SOPS
decryption patched per-env in clusters/dev) — mirroring oauth2-proxy exactly.
The new Kustomization owns the whole platform/headlamp component; its HTTPRoute
moves from platform-config into platform/headlamp/kustomization.yaml. Removed
headlamp from platform/kustomization.yaml and its httproute from
platform-config/kustomization.yaml. Now a crashlooping Headlamp can never stall
platform/platform-config/apps.

Part B (make it start): pin the chart to 0.41.0 (`>=0.41.0 <0.42.0`). The
backend added `f.Int("session-ttl", …)` in v0.41.0 and chart 0.41.0 pins that
same image (appVersion == chart version), so chart+image realign; every arg the
chart renders for our values is supported. OIDC config + per-user RBAC
(clusterRoleBinding.create:false) unchanged.

Gate: `make -C ci gate` PASS.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

clusters/base/headlamp.yaml

@@ -0,0 +1,45 @@
+---
+# Flux Kustomization: headlamp dashboard — reconciles ./platform/headlamp.
+#
+# POST-PLATFORM TIER (dependsOn platform-config). Headlamp is a LEAF Kubernetes-dashboard UI that
+# depends on Keycloak (native-OIDC login) + the trusted wildcard TLS cert + split-horizon DNS + the
+# Gateway API CRDs — all brought up by `platform` (controllers) and `platform-config` (Keycloak
+# instance/realm CRs, the wildcard Certificate, cilium L2 VIP, Gateway). It therefore MUST NOT live
+# inside the gating `platform` tier: a UI HelmRelease whose image/chart can crashloop (e.g. the
+# upstream headlamp-0.40.1 `-session-ttl` chart/image desync, issue #4883) would keep `platform`
+# not-Ready, and while `platform` is not-Ready NOTHING downstream reconciles — platform-config,
+# oauth2-proxy, every apps-wave and apps-vms all stall on "dependency not ready". That is exactly
+# how a single leaf UI stalled the whole chain (DECISIONS-LOG: "Headlamp gating stall"). This is the
+# same lesson oauth2-proxy already encodes: a leaf that can be legitimately unhealthy must reconcile
+# in its OWN post-platform Kustomization so its health can never gate the graph.
+#
+# NON-GATING (wait:false): nothing in the graph dependsOn headlamp (apps waves gate on
+# platform-config, not on this), and a dashboard pod can be long-not-Ready during a cold start while
+# it waits on Keycloak/DNS/TLS — same rationale as oauth2-proxy and apps-vms. wait:false guarantees
+# its health can NEVER gate anything, even if a future resource is (mistakenly) pointed dependsOn it.
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: headlamp
+  namespace: flux-system
+spec:
+  interval: 10m
+  retryInterval: 2m
+  timeout: 5m
+  prune: true
+  wait: false
+  dependsOn:
+    - name: platform-config   # Keycloak instance/realm + wildcard TLS + split-horizon VIP + Gateway first
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./platform/headlamp
+  # Same cluster-vars ConfigMap the platform tier fed it before the move (headlamp itself references
+  # no ${VARS} today, but the substitution is retained for parity with the other tiers/future knobs).
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-vars
+  # SOPS decryption for headlamp-oidc-credentials.sops.yaml is layered per-environment by the overlay
+  # (clusters/dev patches THIS Kustomization by name), identical to how it was decrypted via the
+  # `platform` Kustomization before the move. See clusters/dev/kustomization.yaml.

clusters/base/kustomization.yaml

@@ -21,4 +21,9 @@ resources:
   # service that needs Keycloak + trusted TLS + split-horizon DNS must NOT sit in the gating
   # `platform` tier, where it self-gated its own dependencies into a cold-start deadlock (twice).
   - oauth2-proxy.yaml    # Flux Kustomization -> ./platform/oauth2-proxy (dependsOn platform-config)
+  # headlamp dashboard — POST-platform tier (dependsOn platform-config, wait:false). A leaf UI whose
+  # HelmRelease can crashloop (upstream headlamp-0.40.1 `-session-ttl` chart/image desync) must NOT
+  # sit in the gating `platform` tier, where its unhealth stalled platform-config + oauth2-proxy +
+  # every apps wave/vm on "dependency not ready" (DECISIONS-LOG: "Headlamp gating stall").
+  - headlamp.yaml        # Flux Kustomization -> ./platform/headlamp (dependsOn platform-config)
   - cluster-vars.yaml    # overlay knob surface (base defaults)