ADRs: the in-cluster Collector, and the Vault policy job with the gate's ConfigMap #205

Parent

#195

What to build

The two in-cluster decisions as decision records, with their spec text, in one small PR:

• The ClusterState Collector runs in the cluster. It is read-only and commits the snapshot to the Estate repository through a GitHub App, only when the snapshot changes. This settles who runs 0034's collector; it goes in chapter 20.
• An in-cluster job applies the rendered Vault policies and roles. The job runs in the apps-vso-secrets unit, before any Application that holds a grant. The Release Gate reads each Application's releaseGate from a ConfigMap the render writes. This answers chapter 55's open "who writes the policies"; it goes in chapters 30 and 55.

Acceptance criteria

• Two ADRs, numbered from the next free estate-wide number, with Alternatives, register rows and resolving anchors.
• Chapters 20, 30 and 55 state what they decide.
• npm run verify passes.

Blocked by

None (can start immediately).