refactor(iac): cluster split — 1 cluster per plane, breakpilot-* naming

Restructures the draft to reflect the 2026-06-30 cluster decision:

Three Orca clusters, each becoming its own Gitea repo at migration time:
- breakpilot-edge   → vm-edge       (Identity + Infra: KC, Gitea, Infisical, PowerDNS, Orca-Proxy)
- breakpilot-control → vm-control   (Portal, tenant-registry, ERPNext, MariaDB, Stalwart)
- breakpilot-app    → vm-app-prod + vm-app-stage (CERTifAI, compliance-*, Mongo, MinIO, Qdrant, LiteLLM)

Key model points encoded:
- Identity (Keycloak) co-tenant with Infra on vm-edge (1 VM core), per
  INFRASTRUCTURE.md §6 — heap pinned so it cannot starve PowerDNS/Infisical
- Stage and prod live in the same breakpilot-app cluster on different
  VMs. Stage authenticates via prod Keycloak under tenant.kind = "stage";
  no duplicated identity, no duplicated control plane (per §5).
- The existing CERTifAI Keycloak will be repurposed for breakpilot-edge
  rather than standing up a fresh one — same realm, same users.
- Multi-VM rollout gated on legal entity being established so we can sign
  SysEleven / Hetzner business contracts. Until then, single-VM ops
  continues via ~/workspace/orca-infra; this repo is design-only.

Mechanical changes:
- manifests/{vm-edge,vm-control,vm-data,stage}/ → clusters/{breakpilot-edge,breakpilot-control,breakpilot-app/services/{prod,stage}}/services/
- vm-data → vm-app-prod, stage → vm-app-stage in node references and headers
- overlays/{stage,prod}/overlay.toml point at the new cluster paths
- scripts/validate.sh now enforces a per-cluster node whitelist
  (breakpilot-edge → vm-edge, breakpilot-control → vm-control,
  breakpilot-app → {vm-app-prod, vm-app-stage}) instead of dir-name equality
- New READMEs at clusters/, clusters/breakpilot-edge/,
  clusters/breakpilot-control/, clusters/breakpilot-app/ documenting
  scope, SLA targets, co-tenant notes, and the future-repo split
- Top README rewritten to lead with the cluster-split decision and the
  legal-entity gate; per-milestone fill-in table re-pathed

Validation:
- make validate → 38 files OK (35 manifests + 3 overlays)
- make plan ENV=stage → 11 resolved manifests in .orca-out/stage/
- make plan ENV=prod  → 24 resolved manifests in .orca-out/prod/

scripts/validate.sh

@@ -11,7 +11,16 @@ import sys, tomllib, pathlib
 root = pathlib.Path(sys.argv[1])
 errs = []
 count = 0
-for p in sorted(root.glob('manifests/**/*.toml')):
+
+# Cluster → expected node names. Each cluster ships its own VM(s); a service's
+# placement.node must be one of the cluster's declared VMs.
+CLUSTER_NODES = {
+    'breakpilot-edge':    {'vm-edge'},
+    'breakpilot-control': {'vm-control'},
+    'breakpilot-app':     {'vm-app-prod', 'vm-app-stage'},
+}
+
+for p in sorted(root.glob('clusters/*/services/**/*.toml')):
     count += 1
     try:
         data = tomllib.load(open(p, 'rb'))
@@ -22,6 +31,13 @@ for p in sorted(root.glob('manifests/**/*.toml')):
     if not svcs:
         errs.append(f'{p}: no [[service]] block')
         continue
+    # cluster name = first path component under clusters/
+    rel = p.relative_to(root)
+    cluster = rel.parts[1]  # clusters/<cluster>/services/...
+    expected_nodes = CLUSTER_NODES.get(cluster)
+    if expected_nodes is None:
+        errs.append(f'{p}: unknown cluster "{cluster}" (expected one of {sorted(CLUSTER_NODES)})')
+        continue
     for svc in svcs:
         for required in ('name', 'image'):
             if required not in svc:
@@ -32,13 +48,11 @@ for p in sorted(root.glob('manifests/**/*.toml')):
                 for fb in ('depends_on', 'extra_ports', 'cmd', 'mounts'):
                     if fb in svc[sub]:
                         errs.append(f'{p}: "{fb}" nested under [service.{sub}] — must be at [[service]] level')
-        # placement.node must match parent vm directory
         node = (svc.get('placement') or {}).get('node')
-        vm_dir = p.parent.name
-        if node and node != vm_dir:
-            errs.append(f'{p}: placement.node "{node}" mismatches dir "{vm_dir}"')
         if not node:
             errs.append(f'{p}: missing placement.node')
+        elif node not in expected_nodes:
+            errs.append(f'{p}: placement.node "{node}" not valid for cluster "{cluster}" (expected one of {sorted(expected_nodes)})')
         mem = (svc.get('resources') or {}).get('memory')
         if not mem:
             errs.append(f'{p}: missing resources.memory (mandatory per §8 rule 5)')