fix(monitoring): move PrometheusRule alerts to platform-config (CRD ordering)

Enabling monitoring deadlocked the platform Kustomization: alerts.yaml ships
PrometheusRule CRs whose monitoring.coreos.com CRDs are installed by the
kube-prometheus-stack HelmRelease in the SAME pass → 'no matches for kind
PrometheusRule' → atomic apply failure → NO monitoring HelmReleases created.
Same controllers/configs fix as cert-manager/kyverno: drop alerts.yaml from
platform/monitoring and apply it via platform-config (dependsOn platform), so the
monitoring CRDs exist first. Verified: platform has 0 PrometheusRule (keeps the 3
monitoring HRs); platform-config has the 8 alert rules; gate PASS.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform-config/kustomization.yaml

@@ -29,3 +29,5 @@ resources:
   # cilium: L2 LB IP pool + announcement policy (cilium.io CRDs already registered by Cilium)
   - cilium/l2-ip-pool.yaml
   - cilium/l2-announcement-policy.yaml
+  # monitoring: PrometheusRule alert rules (need monitoring.coreos.com CRDs from kube-prometheus-stack)
+  - ../platform/monitoring/alerts.yaml

platform/monitoring/kustomization.yaml

@@ -7,6 +7,8 @@ resources:
   - kube-prometheus-stack.yaml
   - loki.yaml
   - alloy.yaml
-  - alerts.yaml
+  # NOTE: alerts.yaml (PrometheusRule CRs) needs the monitoring.coreos.com CRDs that the
+  # kube-prometheus-stack HelmRelease above installs → applied by the platform-config Kustomization
+  # (dependsOn platform) so the CRDs exist first. File stays here for locality.
   - grafana-admin-credentials.sops.yaml
   - alertmanager-smtp.sops.yaml