[ci skip] VPA: reduce LimitRange defaults, add overcommit check, protect tier-0

- Reduce Kyverno LimitRange default limits ~4x across all tiers to fix
  800-900% memory overcommitment on worker nodes
- Add cluster health check #25: per-node resource overcommitment
  showing requests and limits vs allocatable capacity
- Add Kyverno policy for Goldilocks VPA mode by tier: tier-0 namespaces
  get VPA Off mode (recommend only, no evictions) to prevent downtime
  on critical infra (traefik, cloudflared, authentik, technitium, etc.)
- Non-tier-0 namespaces get VPA Auto mode for active right-sizing

stacks/platform/modules/vpa/main.tf

@@ -84,3 +84,93 @@ module "ingress" {
 
   depends_on = [helm_release.goldilocks]
 }
+
+# -----------------------------------------------------------------------------
+# Kyverno policy — label namespaces for VPA mode by tier
+# -----------------------------------------------------------------------------
+# Goldilocks reads the goldilocks.fairwinds.com/vpa-update-mode label on
+# namespaces to decide the updateMode for VPA objects it creates.
+# Tier 0-core gets "off" (recommend only — these are critical infra where
+# evictions cause downtime). All other namespaces get "auto".
+
+resource "kubernetes_manifest" "vpa_auto_mode_label" {
+  manifest = {
+    apiVersion = "kyverno.io/v1"
+    kind       = "ClusterPolicy"
+    metadata = {
+      name = "goldilocks-vpa-auto-mode"
+      annotations = {
+        "policies.kyverno.io/title"       = "Goldilocks VPA Mode by Tier"
+        "policies.kyverno.io/description" = "Sets VPA update mode per namespace: Off for tier-0 critical infra (no evictions), Auto for all others."
+      }
+    }
+    spec = {
+      rules = [
+        # Tier 0-core: recommend only, never evict
+        {
+          name = "label-vpa-off-tier-0"
+          match = {
+            any = [
+              {
+                resources = {
+                  kinds = ["Namespace"]
+                  selector = {
+                    matchLabels = {
+                      tier = "0-core"
+                    }
+                  }
+                }
+              }
+            ]
+          }
+          mutate = {
+            patchStrategicMerge = {
+              metadata = {
+                labels = {
+                  "goldilocks.fairwinds.com/vpa-update-mode" = "off"
+                }
+              }
+            }
+          }
+        },
+        # All other namespaces: auto mode
+        {
+          name = "label-vpa-auto-default"
+          match = {
+            any = [
+              {
+                resources = {
+                  kinds = ["Namespace"]
+                }
+              }
+            ]
+          }
+          exclude = {
+            any = [
+              {
+                resources = {
+                  selector = {
+                    matchLabels = {
+                      tier = "0-core"
+                    }
+                  }
+                }
+              }
+            ]
+          }
+          mutate = {
+            patchStrategicMerge = {
+              metadata = {
+                labels = {
+                  "goldilocks.fairwinds.com/vpa-update-mode" = "auto"
+                }
+              }
+            }
+          }
+        },
+      ]
+    }
+  }
+
+  depends_on = [helm_release.goldilocks]
+}