feat(observability): retire duplicate Alloy audit collector from Coroot profile #90

🤖 Generated by the Daily AI Engineer

Evidence

The selectable Hetzner Coroot profile currently renders two collectors for the same Kubernetes audit files:

• HelmRelease/monitoring/alloy-audit tails /var/log/audit/kube/audit* and forwards into the legacy Loki path inherited from the default profile.
• HelmRelease/observability/audit-log-forwarder tails the same files and forwards them to Coroot through the shared coroot-api-key/key contract.

The default profile must retain Alloy audit collection, but the explicit Coroot profile should not duplicate every audit event or keep the legacy audit path as an accidental dependency.

Audience and hypothesis

Platform operators selecting Coroot should receive one coherent audit stream. Removing only the inherited alloy-audit release from that opt-in profile should prevent duplicate forwarding while leaving every default Docker/Hetzner payload and the general Alloy pod-log shipper unchanged.

Smallest useful change

Add a reusable deletion component for HelmRelease/monitoring/alloy-audit and apply it only to providers/hetzner/infrastructure-controllers-coroot.

Acceptance criteria

• Default Hetzner still renders exactly one alloy-audit HelmRelease.
• Hetzner Coroot renders no alloy-audit HelmRelease.
• Hetzner Coroot retains exactly one audit-log-forwarder with the existing audit-file glob and API-key contract.
• Docker profiles, default provider payloads, the main Alloy pod-log shipper, Loki, and kube-prometheus-stack remain unchanged.
• The observability option validator fails if the duplicate audit collector returns.
• Both KSail workload validations remain green.

Rough size: S.

Part of #65
Part of #24