initial commit: cirrus edge (Talos + sish)

- talos/: generated base config (gitignored) + patches for control-plane
  scheduling, unprivileged ports and the ingress firewall
- kubernetes/: sish base and cirrus-dev overlay, applied with kubectl
- READMEs incl. production rollout plan

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kubernetes/base/sish/kustomization.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: sish
+resources:
+  - namespace.yaml
+  - deployment.yaml
+configMapGenerator:
+  - name: sish-config
+    files:
+      - config.yml
+# Provided by each overlay:
+#   ConfigMap sish-env     (SISH_DOMAIN, SISH_BIND_HOSTS)
+#   ConfigMap sish-pubkeys (authorized connector public keys)
+#   Secret    sish-hostkey (pinned SSH host key)