initial commit: cirrus edge (Talos + sish)

- talos/: generated base config (gitignored) + patches for control-plane
  scheduling, unprivileged ports and the ingress firewall
- kubernetes/: sish base and cirrus-dev overlay, applied with kubectl
- READMEs incl. production rollout plan

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitignore

@@ -0,0 +1,10 @@
+# Plaintext secrets: never commit, back them up outside this folder
+.secrets/
+
+# Talos generated configs contain cluster PKI and admin credentials (any folder,
+# e.g. a new edge's config generated next to talos/)
+controlplane.yaml
+worker.yaml
+talosconfig
+secrets.yaml
+kubeconfig