image-policy P3 (#17) Batch B1: Lane-A keel on floating no-updater apps

Adds keel.sh force/match-tag/poll(@4h) to three floating-tag + Always
workloads that had no updater (cribl-am-relay, wg-prod, external-dns-mdapi),
moving them cleanly into Lane A. Deployment-metadata annotations only, so no
pod restart. Per user 2026-06-22: all floating app-tier -> Lane A, no
exceptions, force + match-tag.

Author: tillo

external-dns-mdapi/external-dns-mdapi.yml

@@ -77,6 +77,11 @@ metadata:
   namespace: split-horizon
   labels:
     app: external-dns-mdapi
+  annotations:
+    keel.sh/policy: force
+    keel.sh/match-tag: "true"
+    keel.sh/trigger: poll
+    keel.sh/pollSchedule: "@every 4h"
 spec:
   replicas: 1
   strategy:

monitoring-cribl-am-relay/relay.yml

@@ -379,6 +379,10 @@ metadata:
   namespace: cribl
   annotations:
     reloader.stakater.com/auto: "true"
+    keel.sh/policy: force
+    keel.sh/match-tag: "true"
+    keel.sh/trigger: poll
+    keel.sh/pollSchedule: "@every 4h"
 spec:
   replicas: 1
   selector:

vpn/wg-deploy.yml

@@ -3,6 +3,11 @@ kind: Deployment
 metadata:
   name: wg-prod
   namespace: vpn
+  annotations:
+    keel.sh/policy: force
+    keel.sh/match-tag: "true"
+    keel.sh/trigger: poll
+    keel.sh/pollSchedule: "@every 4h"
 spec:
   replicas: 1
   selector: