feat(kro-rgds): BackupPolicy RGD with gold/silver/bronze tiers

[allamand]

Summary

Introduces a kro ResourceGraphDefinition (BackupPolicy) that expands into an ACK-managed AWS Backup stack (BackupVault + BackupPlan + BackupSelection), parameterized by backup tier.

Enables AWS Backup as the data-plane source of truth alongside GitOps for control plane — used for cross-region DR, blue/green cluster migrations, and environment cloning (all three share the same BackupPlan/BackupSelection primitive).

Tiers

Tier	RPO	Retention	Cross-region copy	Cold storage
gold	1h	30d	✅	90d
silver	24h	14d	✅	—
bronze	24h	7d	—	—

Design

• Platform team declares 3 BackupPolicy instances per spoke (one per tier) — typically via the SpokeCluster RGD in a follow-up
• Developers opt in via namespace/PVC label peeks.io/backup-tier=<tier> — BackupSelection matches via propagated EBS volume tags
• No central ConfigMap to maintain — opt-in is declarative in app manifests and auditable with kubectl get ns -l peeks.io/backup-tier=<tier>

What this RGD does NOT cover (documented explicitly in README)

• Secrets → handled by External Secrets Operator
• Anything derivable from Git → Argo CD re-syncs
• Heavy stateful (Postgres, Kafka) → needs application-level backup on top
• PVC restore targeting into a recovery cluster → separate RestoreSelection RGD (future PR)

Validation

• kubectl apply --dry-run=server passes
• RGD applied on hub cluster, status Active/Ready
• instance-bronze.yaml expands into BackupVault + BackupPlan + BackupSelection
• Delete cascades properly (all expanded resources removed)

Files

• rgd-backup-policy.yaml — the ResourceGraphDefinition
• examples/instance-{gold,silver,bronze}.yaml — per-tier example instances
• README.md — use cases (DR, blue/green, cloning), tiers, developer contract, boundaries

[allamand]

Scope expanded → PeEKS DR kit (in-progress, draft)

This PR is moving from a standalone BackupPolicy RGD to a cohesive DR kit telling the full story: produce + consume + heavy-stateful guidance. It will land as a single coherent merge, but expect several iterations before review.

What's added to the scope:

• RestoreSelection RGD — produces static PVs with claimRef (sync-wave -5) so Argo CD can bind them at wave 0. Two approaches being tested: kro-native (RGD generating a K8s Job that pre-creates PVs) vs a two-step fallback (RestoreSelection + external hook). Decision after hub-cluster validation.
• Heavy-stateful patterns — Postgres (pg_basebackup + WAL archive to S3) as the reference, plus a short investigation on how AWS Backup for EKS already handles complex stateful workloads natively (consistency groups, pre/post-snapshot hooks, documented limitations). The goal is to clearly draw the line between "AWS Backup covers this" vs "application-level backup required on top".
• End-to-end drill documentation — cross-region spoke destruction + recreation via SpokeCluster RGD, with Argo CD resync + RestoreSelection hydrating the data plane. Validates the two RGDs compose correctly.

Why a single PR: reviewers get the full Pattern B story in one place. The BackupPolicy alone produces snapshots no-one knows how to consume; the kit as a whole is the artefact.

Keeping this draft until the RestoreSelection approach is validated on the hub cluster and the AWS-Backup-for-EKS investigation informs the Postgres pattern. The existing BackupPolicy work already validated (RGD Active, instance expands correctly, delete cascades) stays — nothing ripped out, only additions.