Sync observability stack to Coroot (+ audit-log-forwarder) like the reference platform

[devantler]

🤖 Generated by the Daily AI Engineer

Problem. The template still scaffolds the retired observability set (kube-prometheus-stack, Loki, Grafana Alloy, OpenCost) while the reference platform has fully migrated to Coroot plus the audit-log-forwarder. New platforms instantiated today start on a stack the suite no longer develops or dogfoods — the template's single largest drift.

Proposed direction. Replace the Prometheus/Loki/Alloy/OpenCost bases with the platform's Coroot + audit-log-forwarder manifests (genericized: no org-specific endpoints/secrets), update the clusters' kustomizations and any dashboards/alerts wiring, and drop the retired bases. Prove the bootstrap flow still converges on both providers.

Rough size. L

Part of #24

[devantler]

🤖 Generated by the Daily AI Engineer

Progress: #82 merged as b7d144ad1314ec9bec360f1dc7580d7729509c4e,
closing child #81. The explicit Docker/Hetzner Coroot fixtures now model complete
OpenCost retirement across workload objects, auth-proxy routing, network policy,
ReferenceGrant, and security exemptions while every real provider render remains
byte-for-byte unchanged by default.

The direction changed after exact-head review prompted read-only live validation:
the reference Platform's OpenCost returns non-zero requested-resource costs but
zero CPU/RAM usage for all 34 namespace allocations because Coroot Prometheus
lacks the standard node/cAdvisor usage series. That live defect is tracked in
devantler-tech/platform#2689; it must not be copied into this template.

The child passed 86-kustomization / 258-file validation for both local and prod,
negative controls for future references and array drift, exact-head CI, Codex
review, and post-merge TODO/CodeQL workflows. No cluster was mutated. Parent #65
remains open for real-provider activation and the remaining rollout slices.