Point tool badges at official sites, restyle to plastic

[Gerrrt]

What changed

README badges only — nothing that runs. The Prometheus, Grafana, Loki and pfSense badges now link to the tools' own sites instead of in-repo paths, and every badge is restyled to shields' plastic. The in-repo config paths those badges gave up now hang off the Stack table's Tool column, so no navigation is lost.

Secrets: SOPS + age becomes two badges — one badge cannot carry two tool links. The ADR stays linked from Highlights, which already had [Why](docs/adr/0005-secrets-with-sops-and-age.md).

The CI badge moves from GitHub's native actions/workflows/ci.yml/badge.svg endpoint to shields' workflow-status endpoint. The native badge has no style parameter, so that swap is what makes it match the rest.

Why

The badges looked right but pointed at the wrong things — clicking Prometheus landed you in stacks/observability/prometheus rather than prometheus.io. This is the reference repo for a badge pass across four sibling repos, so it goes first.

Blast radius

Documentation only. No compose file, config, script or secret is touched.

• No change to network segmentation or firewall rules
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Verification

• npx --yes markdownlint-cli2 — Summary: 0 issues in 0 files across 21 files
• Every shield URL fetched; the dynamic CI badge renders a real status, not invalid
• Every new link target returns 200 (prometheus.io, grafana.com/oss/grafana/, grafana.com/oss/loki/, pfsense.org; getsops/sops and FiloSottile/age confirmed via raw, since this session's proxy 403s unscoped github.com pages)
• Deployed to the lab and confirmed working — n/a, no runtime change
• Docs updated — this is the docs change

---

Generated by Claude Code