docs(context): estate brief — Cygnus single-cluster reality (Lyra decommissioned, GPU→colo)

[todie]

Refresh the cross-harness estate brief constellation section to current ground-truth (2026-07-23 architecture assessment). It still said Lyra is 'retiring / check migration state' and framed the stack as the 'Lyra dev tier'.

• Cygnus is the SOLE cluster; OPS-468 migration DONE; Lyra decommissioned 2026-07-18 (no dev VKE, no rollback target); dual-target deploymentTarget retired.
• GPU/inference pivoted to a rented A100→colo path (OPS-549); in-cluster gpu-pool/Dynamo-Triton abandoned.
• Platform stack reflects live Cygnus: Thanos/Tempo (Jaeger retired)/VictoriaMetrics/Pyrra/Langfuse/Phoenix, SPIRE, Forgejo, LACE; CNPG 3/3; + note that OpenBao/Keycloak/Loki/Tempo remain single-replica SPOFs.

Under the 2400-token budget (~1532). Signed. Re-render (render.sh) refreshes ~/.omp/agent/AGENTS.md + ~/.agents/estate.md.

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[todie]

iac-correctness-critic: APPROVED — all claims live-verified against ~/.kube/cygnus + unsigned-paas docs.

• Cygnus sole cluster / Lyra decommissioned 2026-07-18 (OPS-468 done): confirmed — single kubeconfig context, no VKE/Lyra namespace or app remnants; matches project memory project_constellation_naming.md.
• GPU pivot to A100→colo (OPS-549): confirmed — docs/platform-roadmap.md:36, docs/architecture/overview.md:220; live cluster has zero GPU-labeled nodes, no triton/dynamo pods.
• Platform stack: Thanos (thanos-query/thanos-store-gateway), Tempo (tempo-0; no Jaeger pods), VictoriaMetrics (vmsingle-0), Pyrra, Langfuse+Phoenix namespaces, SPIRE (spire-server+agents), Forgejo, LACE (kagent+hermes-agent) — all present and Running live.
• SPOF note: OpenBao/Keycloak/Loki/Tempo StatefulSets all confirmed 1/1 (single-replica) live.
• ArgoCD sync model ("manual for stateful/CRD/credential + small auto-sync set"): confirmed — 12/75 Applications carry syncPolicy.automated, and they're edge/observability apps (cloudflared, traefik, cert-manager, external-dns/secrets, prometheus/grafana, tailscale, priority-classes, gitops-root, lace-deploy, blackbox-exporter), not stateful/credential apps.
• Token budget: render.sh on the PR content reports ≈1532 tokens, matches the PR body's claim and is under the 2400 gate.

Minor (non-blocking) note: platform-pg CNPG cluster was mid-failover (2/3 ready) at check time — the "3/3" in the doc describes topology/instance-count, not momentary health, so this doesn't contradict the claim.