chore(tra-976): AKS burndown — deprovision Azure demo cluster

[mikestankavich]

What

Burned down the stopped AKS demo stack (TRA-976) to stop the ~$40/mo Azure run rate, preserving the aks.trakrf.app DNS delegation zone. Mirrors the 2026-04-21 EKS burndown. GKE is the forward bet; AKS stays a contingency/portfolio target, rebuildable via just azure.

A stopped cluster bills ~$25/mo for a Standard load balancer + 2 static IPs fronting a cluster nobody can reach, plus ~$5 ACR and small disks — pure waste for a parked asset.

Live teardown (already executed — terraform/azure/*.tf left intact)

• state rm of azurerm_dns_zone.aks_trakrf_app and azurerm_resource_group.main so the destroy preserves the delegation zone and its RG container. (Azure DNS zones can't exist outside an RG — unlike Route53, so the RG must survive too.)
• apply -destroy removed 22 resources: AKS cluster, ACR, Traefik static PIP, vnet/nsg/subnet, cert-manager + CI user-assigned identities, all role assignments, the azuread CI app/SP/groups/federated creds, and the two A records. The MC_ node resource group auto-deleted with the cluster.
• One transient retry: the Traefik PIP's first delete raced the MC_ load balancer; once the cluster finished deleting, the PIP detached and removed cleanly.

Verification

$ az resource list  (excl. NetworkWatcherRG)
  aks.trakrf.app     rg-trakrf-demo-ussc      # preserved zone
  hashspheretfstate  hashsphere-tfstate       # unrelated tfstate backend (untouched)

$ dig +short NS aks.trakrf.app @1.1.1.1
  ns1-03.azure-dns.com.  ns2-03.azure-dns.net.  ns3-03.azure-dns.org.  ns4-03.azure-dns.info.
$ dig +short SOA aks.trakrf.app @1.1.1.1   →  resolves

• ✅ Azure run rate ≈ $0 (only the ~$0.50/mo zone remains)
• ✅ MC_ resource group gone
• ✅ Zone nameservers unchanged — no NS rotation, Cloudflare delegation intact
• ✅ On rebuild, zone + RG re-import cleanly (prevent_destroy guards restored in code)

This PR's diff

Docs-only — reframes AKS stopped → deprovisioned:

• README.md — intro, multi-cloud rationale, repo tour, cost, status sections
• argocd/root/templates/argocd-image-updater.yaml — GKE-only comment

The dated design spec under docs/superpowers/specs/ keeps "AKS stopped" intentionally (historical point-in-time record).

🤖 Generated with Claude Code