fix(platform): control plane runs system-cluster-critical, so eviction refuses it (#8)

Following the first shield attempt (custom class, value 1e6) a live drill
showed the limit: kubelet evicted the game pods and then the api,
operator and registry anyway — evicting them was never what reclaimed
the disk — and with the images containerd-only, the GC stage left
everything in ImagePullBackOff. A custom class cannot be raised past 1e9
(the API caps user-defined values), while kubelet's eviction refusal
needs >= 2e9, so the control plane now uses the built-in
system-cluster-critical.

Re-drilled: disk filled to 1.7G free -> login/lobby evicted, and kubelet
logged "cannot evict a critical pod" for felis-api/operator/registry,
which stayed Running throughout. Recovery facts now in troubleshooting
13b: the DiskPressure condition lingers ~5m after space is freed
(--eviction-pressure-transition-period), and game images GC'd while
their pods were evicted need the documented re-import (verified: 25s to
Running).

internal/platform/bundle.go

@@ -34,9 +34,10 @@ type Object interface {
 // Deployments and the in-cluster registry (Deployment + Service + PVC), which
 // make the SAs and NetworkPolicy peers refer to something real, plus the
 // world-archive PVC that backs backup/restore when a backup PVC is named (see
-// workloads.go). Workloads also carries the one cluster-scoped object, the
-// felis-control-plane PriorityClass (node-pressure eviction shield — a
-// PriorityClass is not namespaced by design); everything else is namespaced.
+// workloads.go). Every object here is namespaced; the control plane's
+// node-pressure eviction shield is the BUILT-IN system-cluster-critical
+// PriorityClass the pod templates reference (workloads.go controlPlanePriorityName),
+// not an object this bundle renders.
 // The reaper CronJob is also part of Workloads, rendered only when the retention
 // storage topology is supplied (WorldsHostPath + BackupPVC + ArchiveLocalPath —
 // workloads.go documents the gate and the shape-asserted hostPath caveat). The