refactor(iac): cluster split — 1 cluster per plane, breakpilot-* naming (#6)

3 Orca clusters (breakpilot-edge / breakpilot-control / breakpilot-app), 1 plane each. Single-VM core with Keycloak co-tenant on vm-edge. App cluster gets prod + stage VMs. Manifests reorganized into clusters/<name>/services/; validator now enforces per-cluster node whitelist. Multi-VM rollout gated on legal entity.

overlays/prod/overlay.toml

@@ -1,14 +1,22 @@
 # Prod overlay.
 #
-# Selects manifests under vm-edge / vm-control / vm-data. Stage manifests
-# (manifests/stage/) are excluded from prod apply.
+# Selects services from all three clusters' prod paths:
+#   - breakpilot-edge: identity + infra (Keycloak, Gitea, Infisical, PowerDNS, Orca-Proxy)
+#   - breakpilot-control: portal, tenant-registry, ERPNext, Frappe HD, Stalwart
+#   - breakpilot-app/services/prod: certifai, compliance-*, Mongo, MinIO, Qdrant, LiteLLM
+#
+# Stage services (breakpilot-app/services/stage/) are excluded from prod apply.
 
 [env]
 name = "prod"
 api_url = "${ORCA_PROD_API_URL}"
 
 [deploy]
-include_dirs = ["manifests/vm-edge", "manifests/vm-control", "manifests/vm-data"]
+include_dirs = [
+    "clusters/breakpilot-edge/services",
+    "clusters/breakpilot-control/services",
+    "clusters/breakpilot-app/services/prod",
+]
 
 [image]
 # Default tag for prod; release.yaml retags `env-stage` → `v$VERSION` + `env-prod`.