chore(flux): restore platform prune:true — MERGE 2 of 2 (Cilium split cleanup)

Closes the transition opened in merge 1 (63f98aa). `prune: true` is restored on the
`platform` Kustomization now that the ownership transfer is VERIFIED on the live cluster,
not merely expected:

  13/13 Kustomizations Ready, `cilium` among them, at main@sha1:23aa2854
  Namespace/kube-system          label kustomize.toolkit.fluxcd.io/name = cilium
  HelmRelease/cilium             label ... = cilium
  HelmRepository/cilium          label ... = cilium
  platform  inventory: 0 entries matching kube-system__Namespace | kube-system_cilium_*
  cilium    inventory: exactly those three objects
  Cilium pods UNCHANGED from the pre-merge baseline —
    cilium-2f8h8 r=0 2026-09-01T05:55:27Z
    cilium-425m8 r=1 2026-08-30T13:25:10Z
    cilium-54cww r=0 2026-09-01T05:55:26Z
  HelmRelease still v11

So the relabel deterministically preceded any prune, exactly as the revision-gated
dependsOn edge predicted, and the ownership move cost zero pod restarts.

The in-file comment now records the lesson rather than the temporary state: before moving
ANY platform/* component in future, check whether it is the sole declarer of a shared
Namespace. platform/cilium/namespace.yaml was the only declaration of Namespace/kube-system
under ./platform, which would have turned a component-scoped prune into
`delete namespace kube-system` — taking coredns, metrics-server, local-path and Cilium.

L0 substitution gate: 103 assertions, 0 hazards.

Serves: R-PLAT-01, R-GITOPS-01.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

clusters/base/platform.yaml

@@ -11,27 +11,18 @@ spec:
   interval: 10m
   retryInterval: 2m
   timeout: 5m
-  # ======================= TEMPORARY — prune:false TRANSITION STATE =======================
-  # RESTORE TO `prune: true` IN THE VERY NEXT MERGE. This is step 1 of the documented Flux
-  # procedure for MOVING RESOURCES BETWEEN KUSTOMIZATIONS (fluxcd.io/flux/faq: "set spec.prune to
-  # false, sync, move the manifests, then re-enable pruning"), used here to move ./platform/cilium
-  # out of this tier and into its own `cilium` Kustomization (clusters/base/cilium.yaml).
+  # Cilium was moved OUT of this tier into its own Kustomization (clusters/base/cilium.yaml)
+  # on 2026-09-01. `prune: true` is restored here now that the ownership transfer is VERIFIED
+  # live: Namespace/kube-system, the Cilium HelmRelease and the HelmRepository all carry
+  # `kustomize.toolkit.fluxcd.io/name=cilium`, this Kustomization's inventory no longer lists
+  # any of the three, and the `cilium` Kustomization's inventory holds exactly those three.
   #
-  # WHY IT IS NOT OPTIONAL: `platform/cilium/namespace.yaml` is the ONLY declaration of
-  # Namespace/kube-system anywhere under ./platform, and the live object carries
-  # `kustomize.toolkit.fluxcd.io/name=platform`. The moment ./platform/cilium leaves this
-  # Kustomization's rendered path, Namespace/kube-system + the Cilium HelmRepository/HelmRelease
-  # become STALE in this Kustomization's inventory. With prune:true that is not "uninstall the
-  # CNI" — it is `kubectl delete namespace kube-system`, which takes the whole cluster.
-  #
-  # A SECOND, INDEPENDENT PROTECTION IS ALSO IN PLACE (belt and braces, deliberately):
-  # kustomize-controller's pruner passes `Inclusions: GetOwnerLabels(platform, flux-system)`, so it
-  # only deletes objects whose LIVE labels still say they belong to `platform`. The new `cilium`
-  # Kustomization relabels all three objects to `name=cilium` when it applies them, and the
-  # `dependsOn: [cilium]` edge below is REVISION-gated — `platform` cannot reconcile revision N
-  # until `cilium` has APPLIED revision N. So the relabel provably precedes the prune. Neither
-  # mechanism is trusted alone for an object of this blast radius.
-  prune: false         # <-- TEMPORARY; see block above. Normal value: true (R-GITOPS-03)
+  # LESSON WORTH KEEPING: `platform/cilium/namespace.yaml` was the ONLY declaration of
+  # Namespace/kube-system under ./platform. Moving that path out of a prune:true Kustomization
+  # made the stale set `delete namespace kube-system` — coredns, metrics-server, local-path AND
+  # Cilium. Before moving ANY platform/* component in future, check whether it is the sole
+  # declarer of a shared Namespace; that turns a component-scoped prune into a cluster-scoped one.
+  prune: true
   wait: true           # block `apps` until platform is healthy
   # ORDERING FIX (2026-09-01 incident: a substitution race that failed OPEN broke Cilium).
   #