feat(monitoring): add Loki + Promtail for pod log viewing in Grafana

[OmkarDeshpande7]

Summary

• Adds Loki (log storage) and Promtail (log collector) to the monitoring stack
• Promtail ships only migration-system namespace logs — all other namespaces dropped at collector
• Loki stores logs on a 10Gi PVC with 7-day retention
• Grafana datasource pre-configured to query Loki
• Loki and Promtail images pre-baked into appliance QCOW2 for airgap support

Changes

New manifests (k8s/kube-prometheus/manifests/):

• loki-serviceAccount.yaml, loki-configMap.yaml, loki-pvc.yaml, loki-statefulset.yaml, loki-service.yaml
• promtail-serviceAccount.yaml, promtail-clusterRole.yaml, promtail-clusterRoleBinding.yaml, promtail-configMap.yaml, promtail-daemonset.yaml

Modified:

• k8s/kube-prometheus/manifests/grafana-dashboardDatasources.yaml — adds Loki datasource
• image_builder/scripts/download_images.sh — pre-pulls grafana/loki:3.5.0 and grafana/promtail:3.5.0

Test plan

• Deploy to vJailbreak appliance — verify Loki pod starts and PVC binds
• Verify Promtail DaemonSet pod running on all nodes
• Confirm Grafana → Explore → Loki datasource shows migration-system logs
• Confirm no logs from other namespaces appear
• Verify airgap: on appliance with no internet, images load from pre-baked tarballs

🤖 Generated with Claude Code

[github-actions]

✅ Security Vulnerability Summary

No change in security posture

📊 Overall Changes

Metric	Count
Total Added	0
Total Fixed	0
Net Change	0

🔍 Detailed Breakdown

📦 Gosec (Static Analysis)

Current	Baseline	Added	Fixed	Method
0	0	0	0	artifact

📦 Trivy (Dependency Scan)

Current	Baseline	Added	Fixed	Method
82	82	0	0	artifact

📋 Baseline Methods

• 📦 artifact: Used stored report from main branch
• 🔄 live_scan: Scanned base branch in real-time
• ⚠️ no_baseline: No baseline available (all vulnerabilities treated as new)

---

Only HIGH and CRITICAL severity vulnerabilities are tracked
Baseline: 7a2cb17254fbd60af287aa9381f3bd985660a058