feat(08-02): deploy Grafana Alloy for log collection

- Add helm/alloy Chart.yaml as umbrella chart for grafana/alloy
- Configure Alloy River config for Kubernetes pod log discovery
- Set up loki.write endpoint to forward logs to Loki
- Configure DaemonSet with control-plane tolerations for all 5 nodes

Replaces Promtail (EOL March 2026) with Grafana Alloy

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

helm/alloy/Chart.yaml

@@ -0,0 +1,8 @@
+apiVersion: v2
+name: alloy
+description: Grafana Alloy log collector
+version: 0.1.0
+dependencies:
+  - name: alloy
+    version: "0.12.*"
+    repository: https://grafana.github.io/helm-charts

helm/alloy/values.yaml

@@ -0,0 +1,52 @@
+alloy:
+  alloy:
+    configMap:
+      content: |
+        // Discover pods and collect logs
+        discovery.kubernetes "pods" {
+          role = "pod"
+        }
+
+        // Relabel to extract pod metadata
+        discovery.relabel "pods" {
+          targets = discovery.kubernetes.pods.targets
+
+          rule {
+            source_labels = ["__meta_kubernetes_namespace"]
+            target_label  = "namespace"
+          }
+          rule {
+            source_labels = ["__meta_kubernetes_pod_name"]
+            target_label  = "pod"
+          }
+          rule {
+            source_labels = ["__meta_kubernetes_pod_container_name"]
+            target_label  = "container"
+          }
+        }
+
+        // Collect logs from discovered pods
+        loki.source.kubernetes "pods" {
+          targets    = discovery.relabel.pods.output
+          forward_to = [loki.write.default.receiver]
+        }
+
+        // Forward to Loki
+        loki.write "default" {
+          endpoint {
+            url = "http://loki-stack.monitoring.svc.cluster.local:3100/loki/api/v1/push"
+          }
+        }
+
+  controller:
+    type: daemonset
+    tolerations:
+      - key: node-role.kubernetes.io/master
+        operator: Exists
+        effect: NoSchedule
+      - key: node-role.kubernetes.io/control-plane
+        operator: Exists
+        effect: NoSchedule
+
+  serviceAccount:
+    create: true