Add platform infrastructure configuration

services/observability/README.md

@@ -0,0 +1,18 @@
+# Observability core
+
+This root composes the internal observability workloads deployed after the
+namespace, CRD, and Local PV prerequisites:
+
+- kube-prometheus-stack without Grafana or its bundled node-exporter;
+- single-binary Loki and Tempo using isolated AIStor buckets;
+- Alloy for Pod logs and internal OTLP/gRPC traces;
+- a standalone node-exporter;
+- the exact core NetworkPolicy matrix, platform rules, scrape targets, verified
+  dashboards, and source-only Alertmanager Slack routing.
+
+It intentionally does not create public ingress, Grafana, OIDC, or credential
+Secrets. The Slack routing source references
+`alertmanager-slack-webhook/url`; while that Secret is absent, do not apply the
+AlertmanagerConfig, its kube-prometheus-stack reference, its public HTTPS
+NetworkPolicy, or alert rules. Namespace, CRD, and Local PV roots remain outside
+this aggregate because their protected apply order is different.