feat(observability): retire Loki and Alloy from Coroot profiles #96

🤖 Generated by the Daily AI Engineer (Codex instance)

Evidence

The selectable Coroot profiles delivered under #65 still inherit the legacy Loki and Grafana Alloy controller payload from each provider's default observability stack:

• Docker Coroot renders HelmRelease/monitoring/loki, HelmRelease/monitoring/alloy, and HelmRelease/monitoring/alloy-audit.
• Hetzner Coroot renders Loki and the pod-log Alloy collector; its audit Alloy collector was already replaced by audit-log-forwarder in fix(observability): avoid duplicate audit forwarding in Coroot profile #91.
• kube-prometheus-stack still carries a Grafana Loki datasource in those profiles.
• The reference Platform's current main has Coroot and the audit-log-forwarder but no Loki or Alloy controller manifests.

Keeping the pair means an operator selecting Coroot still runs a second log backend and collector path, so the profile does not yet deliver the resource reduction or reference-platform parity promised by #65.

Smallest useful change

Retire the coupled Loki + Alloy logging pair from both Coroot profiles only. Preserve the default Docker and Hetzner renders byte-for-byte. Remove the now-dead Grafana Loki datasource and Grafana chart source from the Coroot renders; Tetragon now uses HelmRepository/cilium, so no surviving Coroot-profile release consumes HelmRepository/grafana.

This is intentionally separate from retiring kube-prometheus-stack: metrics and alerting can move in a later independently-proven slice.

Acceptance criteria

• Default Docker and Hetzner controller renders still contain Loki plus both Alloy releases and HelmRepository/grafana.
• Docker and Hetzner Coroot controller renders contain no HelmRelease named loki, alloy, or alloy-audit.
• Coroot-profile Grafana values contain no Loki datasource or loki.monitoring.svc reference.
• Coroot profiles contain no unconsumed HelmRepository/monitoring/grafana.
• The Coroot-profile validation fails if either provider loses a deletion, retains the dead source, or if the default profiles change.
• Both KSail workload validations, naming validation, and the observability-option gate stay green.

Part of #65