Add advise-mode VerticalPodAutoscaler for every workload

Adds a VerticalPodAutoscaler (updateMode: Off, recommendation-only) targeting
every Deployment and StatefulSet across apps/base. Off mode never mutates pods,
so this only gathers right-sizing recommendations. CNPG Clusters and CronJobs
are not VPA targets and are skipped.

apps/base/puppet/kustomization.yaml

@@ -36,6 +36,7 @@ resources:
   - service_puppetboard.yaml
   - service_puppetdb.yaml
   - deployment_puppetserver-compiler.yaml
+  - vpa.yaml
 
 configMapGenerator:
   - name: compiler-autosign.conf

apps/base/puppet/vpa.yaml

@@ -0,0 +1,64 @@
+---
+apiVersion: autoscaling.k8s.io/v1
+kind: VerticalPodAutoscaler
+metadata:
+  name: puppetboard-vpa
+  namespace: puppet
+  # NOTE: this workload also has an HPA. updateMode Off is recommendation-only
+  # and does not act, so there is no HPA/VPA conflict today. Do not flip to Auto/
+  # Initial without first moving the HPA off CPU/memory (VPA owns those under Auto).
+spec:
+  targetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: puppetboard
+  updatePolicy:
+    updateMode: "Off"
+---
+apiVersion: autoscaling.k8s.io/v1
+kind: VerticalPodAutoscaler
+metadata:
+  name: puppetdb-vpa
+  namespace: puppet
+  # NOTE: this workload also has an HPA. updateMode Off is recommendation-only
+  # and does not act, so there is no HPA/VPA conflict today. Do not flip to Auto/
+  # Initial without first moving the HPA off CPU/memory (VPA owns those under Auto).
+spec:
+  targetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: puppetdb
+  updatePolicy:
+    updateMode: "Off"
+---
+apiVersion: autoscaling.k8s.io/v1
+kind: VerticalPodAutoscaler
+metadata:
+  name: puppetserver-compiler-vpa
+  namespace: puppet
+  # NOTE: this workload also has an HPA. updateMode Off is recommendation-only
+  # and does not act, so there is no HPA/VPA conflict today. Do not flip to Auto/
+  # Initial without first moving the HPA off CPU/memory (VPA owns those under Auto).
+spec:
+  targetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: puppetserver-compiler
+  updatePolicy:
+    updateMode: "Off"
+---
+apiVersion: autoscaling.k8s.io/v1
+kind: VerticalPodAutoscaler
+metadata:
+  name: puppetserver-master-vpa
+  namespace: puppet
+  # NOTE: this workload also has an HPA. updateMode Off is recommendation-only
+  # and does not act, so there is no HPA/VPA conflict today. Do not flip to Auto/
+  # Initial without first moving the HPA off CPU/memory (VPA owns those under Auto).
+spec:
+  targetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: puppetserver-master
+  updatePolicy:
+    updateMode: "Off"