Expose the staged Coroot profile as a selectable cluster option #88

🤖 Generated by the Daily AI Engineer

Evidence and problem

The Coroot operator, Coroot custom resource, Hetzner audit-log-forwarder, and complete OpenCost-retirement contract are now proven by the explicit fixtures delivered in #79 and #82. Those fixtures live under k8s/testdata/observability-option/, however, so an operator cannot select the reviewed profile without copying test-only wiring into template-owned provider files. Template sync would then overwrite that local edit.

The instance-owned ksail.yaml and ksail.prod.yaml files already select a cluster Kustomize path and are excluded from template sync. A stable alternate cluster path can therefore expose the staged profile as a real default-off option while preserving every existing Docker and Hetzner render.

The reference Platform still has a live Coroot/OpenCost usage-series defect tracked by devantler-tech/platform#2689. This slice must retire OpenCost in the opt-in profile exactly as #82 proves; it must not point OpenCost at Coroot Prometheus or claim replacement cost allocation.

Audience, hypothesis, and signal

Platform-template operators who want to evaluate Coroot currently have no supported selection path. If the reviewed fixtures become stable provider overlays selected through alternate cluster paths, operators can opt in with one instance-owned KSail setting while default users receive no payload change.

Success is an executable render contract showing that both existing cluster paths remain byte-for-byte unchanged and both alternate paths select the stable Coroot overlays with the expected provider-specific resources and no OpenCost object or reference in the controller, infrastructure, or app layers.

Smallest useful change

• Promote the proven Docker and Hetzner Coroot fixture wiring from test-only paths into stable provider overlays/components.
• Add alternate local and production cluster selectors that point the controller, infrastructure, and apps Flux Kustomizations at those overlays; keep bootstrap wiring unchanged.
• Remove Headlamp's OpenCost plugin in both Coroot app profiles so the retired backend leaves no broken consumer.
• Document the one-line spec.workload.kustomizationFile opt-in and its current boundary: Coroot is enabled, OpenCost is absent, and the remaining legacy metrics/log stack is retired by later children of Sync observability stack to Coroot (+ audit-log-forwarder) like the reference platform #65.
• Keep the current clusters/local and clusters/prod paths as the default.

Acceptance criteria

• Default local/Docker and prod/Hetzner cluster plus provider payloads remain byte-for-byte identical to main.
• Stable alternate cluster paths render Flux controller, infrastructure, and apps paths for the corresponding Coroot provider overlays without changing bootstrap paths.
• Both Coroot profiles render exactly one Coroot operator and one Coroot custom resource and contain zero OpenCost objects or references, including Headlamp plugins.
• Docker renders no audit-log-forwarder; Hetzner renders exactly one with the existing shared API-key contract.
• No OpenCost-to-Coroot Prometheus handoff or replacement-cost claim is introduced while devantler-tech/platform#2689 remains open.
• The validation fails when an alternate selector points back to a default provider path, when OpenCost or its Headlamp plugin is reintroduced, or when the provider-specific forwarder boundary is inverted.
• Operator documentation explains how to opt in through the instance-owned KSail config and how to return to the default path.

Rough size: M

Part of #65
Part of #24