feat(observability): deploy policy-reporter for PolicyReport metrics + dashboards (P12, closes #93)

[gangster]

Summary

#102 P12 — closes #93. New observability-policy-reporter module wraps
kyverno/policy-reporter (3.7.4): watches the
PolicyReport/ClusterPolicyReport CRs Kyverno already produces (ADR-014, both validate/mutate and
cosign verifyImages/verifyAttestations) and exposes them as Prometheus metrics
(policy_report_result/cluster_policy_report_result, detailed label mode: namespace, policy, rule,
kind, name, status, severity, category, source) + ships its own bundled Grafana dashboards (Overview,
PolicyReport details, ClusterPolicyReport details) via the same sidecar ConfigMap convention every
other add-on here already uses.

• Deployed on both clusters, same hub/spoke split as OpenCost (P11): the hub (create_dashboards = true) renders the dashboards, the preprod spoke (create_dashboards = false) only emits metrics —
  the hub's federated Mimir (all clusters) datasource renders the spoke's data too.
• Every dashboard panel gets a $cluster filter via the chart's own multicluster option, matching
  the house dashboard convention (Dashboards: filter by cluster/environment and by tenant (template variables + convention) #151) — externalLabels.cluster (ADR-043/044) is already on every
  series regardless of source, so this works with zero extra wiring.
• New enable_policy_reporting cost_profile-style toggle in _base.hcl, explicitly on for both
  platform and preprod in env.hcl — cheap (one small watcher pod, no cloud spend), and the
  PolicyReport volume that matters lives on preprod (tenant environments under Kyverno Enforce; already
  confirmed real data exists there: alpha-checkout-dev/alpha-conformance-dev/etc. PolicyReports +
  ClusterPolicyReports).

Curated alerting ("spikes / new violations" per #93's scope) is deferred to a follow-up commit once
live metric/job names are confirmed against the real deployment — per house convention (verify PromQL
live before committing an alert), not guessed up front.

Test plan

• helm template dry-run against both the hub and spoke value shapes before wiring any Terraform —
  caught that the chart needs monitoring.enabled = true as a separate top-level gate alongside
  the nested serviceMonitor/grafana.dashboards toggles (every monitoring template checks it
  first); confirmed the hub renders 3 dashboard ConfigMaps + a ServiceMonitor, the spoke renders
  only the ServiceMonitor
• tofu fmt -check / tofu validate clean on the new module
• terragrunt validate passes on both new units (platform + preprod)
• terragrunt hcl fmt --check clean on all touched .hcl
• terraform-docs generated for the new module; markdownlint-cli2 clean
• Not applied to any live cluster from this PR

🤖 Generated with Claude Code

[github-actions]

💰 Infracost report

Monthly estimate generated

Estimate details (includes details of unsupported resources)

──────────────────────────────────
72 projects have no cost estimate changes.
Run the following command to see their breakdown: infracost breakdown --path=/path/to/code

──────────────────────────────────
162 cloud resources were detected:
∙ 34 were estimated
∙ 124 were free
∙ 4 are not supported yet, see https://infracost.io/requested-resources:
  ∙ 1 x aws_athena_workgroup
  ∙ 1 x aws_ce_anomaly_monitor
  ∙ 1 x aws_ce_anomaly_subscription
  ∙ 1 x aws_cur_report_definition

_{This comment will be updated when code changes.}

[infracost]

💰 Infracost report

This pull request is aligned with your company's FinOps policies and the Well-Architected Framework.

Monthly estimate generated

Estimate details (includes details of unsupported resources)

Key: * usage cost, ~ changed, + added, - removed

──────────────────────────────────
Key: * usage cost, ~ changed, + added, - removed
2 projects have no cost estimate changes.
Run the following command to see their breakdown: infracost breakdown --path=/path/to/code

──────────────────────────────────

*Usage costs can be estimated by updating [Infracost Cloud settings](https://dashboard.infracost.io/org/reference-platform/settings/usage-cost-defaults), see [docs](https://www.infracost.io/docs/features/usage_based_resources/#infracost-usageyml) for other options.

605 cloud resources were detected:
∙ 76 were estimated
∙ 463 were free
∙ 66 are not supported yet, see https://infracost.io/requested-resources:
  ∙ 36 x aws_subnet
  ∙ 9 x aws_eks_access_entry
  ∙ 4 x aws_identitystore_group
  ∙ 4 x aws_identitystore_user
  ∙ 3 x aws_ecr_lifecycle_policy
  ∙ 2 x aws_ce_cost_allocation_tag
  ∙ 2 x aws_flow_log
  ∙ 2 x aws_vpc
  ∙ 1 x aws_athena_workgroup
  ∙ 1 x aws_ce_anomaly_subscription
  ∙ 1 x aws_cur_report_definition
  ∙ 1 x aws_organizations_organization

---

_{This comment will be updated when code changes.}