feat: User-defined profiles — named presets for policy, quota, scaling, and reconciler tuning

[iAlexeze]

Summary

This PR introduces user-defined profiles — named presets that let teams codify their infrastructure patterns and reuse them across Katalogs and Motifs instead of using Orkestra built-in profiles.

Now you can declare profiles for all six profile classes directly in your Katalog or Motif:

• networkPolicies — named network isolation patterns
• resourceQuotas — capacity tiers for teams or workloads
• limitRanges — pod and container limits
• hpa — autoscaling behaviors
• pdb — pod disruption budgets behaviors
• rollingUpdate — deployment update strategies
• reconciler — controller tuning (workers, resync, queue depth)

Example: Declaring profiles

apiVersion: orkestra.orkspace.io/v1
kind: Katalog
metadata:
  name: platform-operator

profiles:
  networkPolicies:
    - name: allow-monitoring
      description: Allow ingress from the platform monitoring namespace
      ingress:
        - from:
            - namespaceSelector:
                team: platform
      policyTypes: [Ingress]

  resourceQuotas:
    - name: team-medium
      description: Standard allocation for a medium-sized team namespace
      hard:
        pods: "30"
        cpu: "6"
        memory: "12Gi"
        requests.cpu: "3"
        requests.memory: "6Gi"

  reconciler:
    - name: api-service
      workers: 4
      resync: 30s
      queue:
        maxDepth: 200

spec:
  crds:
    namespace:
      operatorBox:
        reconciler:
          profile: api-service
      onCreate:
        networkPolicies:
          - name: "{{ .metadata.name }}-monitoring"
            profile: allow-monitoring
        resourceQuotas:
          - name: "{{ .metadata.name }}-quota"
            profile: team-medium

What's changed

• Profile registry: profiles: block now accepted at the root of any Katalog or Motif
• Resolution order: User-defined profiles resolve before built-ins; Motif-declared profiles merge into the importing Katalog's registry
• Conflict detection: Duplicate names in the same class across Katalog and Motif are a hard error at load time
• LimitRange wired end-to-end: Profile field, collector, validator, runner, and ApplyLimitRangeProfile — previously had no profile support at all
• Merger propagation fixed: profiles: declared in YAML was never reaching Katalog.Profiles — now wired through Merger and KomposeRuntimeKatalog
• ork validate output: Shows profile count per class in Motif output
• Examples: 3 new use-case examples (06-networkpolicy, 07-resourcequota, 08-limitrange) plus 09-user-defined; all 9 have simulate.yaml; root simulate.yaml aggregator added
• Documentation: User-defined profiles concept page, index and reference updated

Test plan

• make ork && make test-unit
• ork validate -f examples/use-cases/profiles/09-user-defined/katalog.yaml
• ork simulate -f examples/use-cases/profiles/simulate.yaml — all 9 pass
• Reference a user profile name that is not declared — ork validate rejects it
• Declare the same profile name in a Katalog and an imported Motif — conflict error