feat(observability): make Coroot the default and delete the Loki, Alloy and OpenCost bases #386

Problem

#65 is still open after all of its sub-issues closed. Coroot is only the opt-in clusters/local-coroot and clusters/prod-coroot profile. The default clusters/local and clusters/prod paths still render Loki, Alloy, OpenCost and the full kube-prometheus-stack, including Grafana. New instances therefore still start on the stack the reference platform retired.

Proposed change

• Point the default cluster paths at the Coroot provider layers. Keep clusters/local-coroot and clusters/prod-coroot as thin aliases of the defaults, so an instance whose instance-owned ksail*.yaml opted in does not break on template-sync.
• Delete the Loki, Alloy and OpenCost controller bases and the providers/hetzner/infrastructure/controllers/loki patch, along with the remove-controllers-loki-alloy, remove-controller-opencost and remove-opencost-references components. The Coroot profile already removes all of these at render time, so their sources can go once nothing renders them.
• Turn the default-off assertions in scripts/validate-observability-option.sh into default-on assertions. Update scripts/tests/test-oauth2-proxy-sso-redirects.sh, scripts/tests/test-heartbeat-image-contract.sh, docs/TEMPLATING.md and docs/dr/alerting.md to match.
• kube-prometheus-stack stays for now, without its UIs as the profile already does. Its Watchdog and PrometheusRules are retired separately in the sibling sub-issue.

Acceptance criteria

• kubectl kustomize k8s/providers/{docker,hetzner}/{infrastructure/controllers,infrastructure,apps}/ renders the Coroot CR, coroot-operator and cluster-heartbeat, plus audit-log-forwarder on hetzner. It renders no loki, alloy, alloy-audit or opencost HelmRelease and no Grafana HelmRepository or UI.
• The rendered default payloads equal the current Coroot-profile payloads on main, apart from the intended path changes. Post the diff in the PR.
• Every gate in AGENTS.md → Validation passes, and both ksail … workload validate runs pass.
• The PR body says how an existing default-path instance migrates on template-sync: Flux prunes Loki, Alloy and OpenCost and their volumes, and installs Coroot.

Part of #65.

🤖 Generated with Claude Code