observability: fix dropped kubelet/cadvisor metrics, add KSM + vmalert k8s.rules

The node scrape jobs labelmapped every node label (~50+ NFD labels) onto
each series, exceeding vminsert's 40-label default so 100% of kubelet and
cadvisor series were silently dropped (vm_rows_ignored_total
reason=too_many_labels). kube-state-metrics, VMAlert and the
kube-prometheus k8s.rules recording rules were also absent, so dashboard
queries like
node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate
had no producer.

- replaces the blanket node labelmap with a single node-name relabel
- renames node jobs so series carry job=kubelet (+ metrics_path) matching
  kube-prometheus selectors
- adds kube-state-metrics (v2.20.0 via artifactapi k8s-registry remote)
  with RBAC, Service and VMServiceScrape
- adds VMAlert wired to vmselect/vminsert, recording rules only
- adds VMRule with the kube-prometheus k8s.rules recording group

apps/base/observability/kustomization.yaml

@@ -6,6 +6,9 @@ resources:
   - namespace.yaml
   - vmcluster.yaml
   - vmagent.yaml
+  - vmalert.yaml
+  - vmrule-k8s.yaml
+  - kube-state-metrics.yaml
   - gateway.yaml
   - httproute.yaml
   - vmpodscrape-cnpg.yaml