refactor(iac): cluster split — 1 cluster per plane, breakpilot-* naming (#6)

3 Orca clusters (breakpilot-edge / breakpilot-control / breakpilot-app), 1 plane each. Single-VM core with Keycloak co-tenant on vm-edge. App cluster gets prod + stage VMs. Manifests reorganized into clusters/<name>/services/; validator now enforces per-cluster node whitelist. Multi-VM rollout gated on legal entity.

overlays/prod/overlay.toml

@@ -1,14 +1,22 @@
 # Prod overlay.
 #
-# Selects manifests under vm-edge / vm-control / vm-data. Stage manifests
-# (manifests/stage/) are excluded from prod apply.
+# Selects services from all three clusters' prod paths:
+#   - breakpilot-edge: identity + infra (Keycloak, Gitea, Infisical, PowerDNS, Orca-Proxy)
+#   - breakpilot-control: portal, tenant-registry, ERPNext, Frappe HD, Stalwart
+#   - breakpilot-app/services/prod: certifai, compliance-*, Mongo, MinIO, Qdrant, LiteLLM
+#
+# Stage services (breakpilot-app/services/stage/) are excluded from prod apply.
 
 [env]
 name = "prod"
 api_url = "${ORCA_PROD_API_URL}"
 
 [deploy]
-include_dirs = ["manifests/vm-edge", "manifests/vm-control", "manifests/vm-data"]
+include_dirs = [
+    "clusters/breakpilot-edge/services",
+    "clusters/breakpilot-control/services",
+    "clusters/breakpilot-app/services/prod",
+]
 
 [image]
 # Default tag for prod; release.yaml retags `env-stage` → `v$VERSION` + `env-prod`.

overlays/stage/overlay.toml

@@ -1,15 +1,16 @@
 # Stage overlay.
 #
-# Stage maps to the single 'stage' VM, app plane only. Selects only the
-# services under manifests/stage/.
+# Stage maps to vm-app-stage inside the breakpilot-app cluster (sibling of
+# vm-app-prod). Stage workloads point at PROD Keycloak + PROD tenant-registry
+# with tenant.kind = "stage" — identity is not duplicated, isolation is by
+# tenant kind, per INFRASTRUCTURE.md §5.
 
 [env]
 name = "stage"
 api_url = "${ORCA_STAGE_API_URL}"
 
-# Service filter: only deploy manifests under this directory.
 [deploy]
-include_dirs = ["manifests/stage"]
+include_dirs = ["clusters/breakpilot-app/services/stage"]
 
 [image]
 # Default image tag for stage builds. Per-service overrides may land later.