refactor(iac): cluster split — 1 cluster per plane, breakpilot-* naming (#6)

3 Orca clusters (breakpilot-edge / breakpilot-control / breakpilot-app), 1 plane each. Single-VM core with Keycloak co-tenant on vm-edge. App cluster gets prod + stage VMs. Manifests reorganized into clusters/<name>/services/; validator now enforces per-cluster node whitelist. Multi-VM rollout gated on legal entity.

scripts/validate.sh

@@ -11,7 +11,16 @@ import sys, tomllib, pathlib
 root = pathlib.Path(sys.argv[1])
 errs = []
 count = 0
-for p in sorted(root.glob('manifests/**/*.toml')):
+
+# Cluster → expected node names. Each cluster ships its own VM(s); a service's
+# placement.node must be one of the cluster's declared VMs.
+CLUSTER_NODES = {
+    'breakpilot-edge':    {'vm-edge'},
+    'breakpilot-control': {'vm-control'},
+    'breakpilot-app':     {'vm-app-prod', 'vm-app-stage'},
+}
+
+for p in sorted(root.glob('clusters/*/services/**/*.toml')):
     count += 1
     try:
         data = tomllib.load(open(p, 'rb'))
@@ -22,6 +31,13 @@ for p in sorted(root.glob('manifests/**/*.toml')):
     if not svcs:
         errs.append(f'{p}: no [[service]] block')
         continue
+    # cluster name = first path component under clusters/
+    rel = p.relative_to(root)
+    cluster = rel.parts[1]  # clusters/<cluster>/services/...
+    expected_nodes = CLUSTER_NODES.get(cluster)
+    if expected_nodes is None:
+        errs.append(f'{p}: unknown cluster "{cluster}" (expected one of {sorted(CLUSTER_NODES)})')
+        continue
     for svc in svcs:
         for required in ('name', 'image'):
             if required not in svc:
@@ -32,13 +48,11 @@ for p in sorted(root.glob('manifests/**/*.toml')):
                 for fb in ('depends_on', 'extra_ports', 'cmd', 'mounts'):
                     if fb in svc[sub]:
                         errs.append(f'{p}: "{fb}" nested under [service.{sub}] — must be at [[service]] level')
-        # placement.node must match parent vm directory
         node = (svc.get('placement') or {}).get('node')
-        vm_dir = p.parent.name
-        if node and node != vm_dir:
-            errs.append(f'{p}: placement.node "{node}" mismatches dir "{vm_dir}"')
         if not node:
             errs.append(f'{p}: missing placement.node')
+        elif node not in expected_nodes:
+            errs.append(f'{p}: placement.node "{node}" not valid for cluster "{cluster}" (expected one of {sorted(expected_nodes)})')
         mem = (svc.get('resources') or {}).get('memory')
         if not mem:
             errs.append(f'{p}: missing resources.memory (mandatory per §8 rule 5)')