stem95su: scheduled Drive->site sync CronJob (every 10m)

CronJob stem95su-gdrive-sync (*/10) mounts the content PVC RW and
rclone-syncs the read-only Drive folder "claude" (stem claude/files) onto
it (rclone/rclone:1.74.3, scope=drive.readonly, empty-source guard +
--max-delete 25). ESO ExternalSecret stem95su-rclone <- Vault
secret/stem95su. Requires the GCP OAuth app published to Production or the
refresh token expires ~weekly.

Lands the gdrive-sync stack on master (it had landed on a feature branch
by accident on the shared devvm checkout).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

stacks/metallb/main.tf

@@ -1,4 +0,0 @@
-module "metallb" {
-  source = "./modules/metallb"
-  tier   = local.tiers.core
-}

stacks/metallb/modules/metallb/main.tf

@@ -1,70 +0,0 @@
-variable "tier" { type = string }
-
-resource "kubernetes_namespace" "metallb" {
-  metadata {
-    name = "metallb-system"
-    labels = {
-      app                = "metallb"
-      "keel.sh/enrolled" = "true"
-    }
-  }
-  lifecycle {
-    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
-    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
-  }
-}
-
-resource "helm_release" "metallb" {
-  name       = "metallb"
-  repository = "https://metallb.github.io/metallb"
-  chart      = "metallb"
-  version    = "0.15.3"
-  namespace  = kubernetes_namespace.metallb.metadata[0].name
-  timeout    = 600
-
-  values = [yamlencode({
-    controller = {
-      image = {
-        pullPolicy = "IfNotPresent"
-      }
-    }
-    speaker = {
-      image = {
-        pullPolicy = "IfNotPresent"
-      }
-      frr = {
-        enabled = false
-      }
-    }
-  })]
-}
-
-resource "kubernetes_manifest" "ip_address_pool" {
-  manifest = {
-    apiVersion = "metallb.io/v1beta1"
-    kind       = "IPAddressPool"
-    metadata = {
-      name      = "default"
-      namespace = "metallb-system"
-    }
-    spec = {
-      addresses = ["10.0.20.200-10.0.20.220"]
-    }
-  }
-  depends_on = [helm_release.metallb]
-}
-
-resource "kubernetes_manifest" "l2_advertisement" {
-  manifest = {
-    apiVersion = "metallb.io/v1beta1"
-    kind       = "L2Advertisement"
-    metadata = {
-      name      = "default"
-      namespace = "metallb-system"
-    }
-    spec = {
-      ipAddressPools = ["default"]
-    }
-  }
-  depends_on = [helm_release.metallb]
-}

stacks/metallb/secrets

@@ -1 +0,0 @@
-../../secrets

stacks/metallb/terragrunt.hcl

@@ -1,8 +0,0 @@
-include "root" {
-  path = find_in_parent_folders()
-}
-
-dependency "infra" {
-  config_path  = "../infra"
-  skip_outputs = true
-}