fix(observability): roll Alloy on config changes

[gregkonush]

Summary

• Generate the cluster-metrics Alloy ConfigMap with Kustomize content hashing.
• Move the Alloy River configuration into its native .river source file.
• Let Kustomize rewrite the Deployment volume reference so every config change triggers a rolling restart.
• Route .river changes through Argo validation and cover the generated-config contract in tests.

Related Issues

None.

Testing

• nix develop -c kustomize build --enable-helm argocd/applications/observability
• nix develop -c sh -lc 'kustomize build --enable-helm argocd/applications/observability | kubectl apply --dry-run=server -n observability -f -'
• bun run lint:argocd
• bun test packages/scripts/src (532 passing)
• bunx oxfmt --check packages/scripts/src/shared/__tests__/flink-observability-contract.test.ts packages/scripts/src/ci/__tests__/impact-router.test.ts
• Compared the extracted River payload with origin/main; no configuration content changed.
• Verified the rendered Deployment references the generated hashed ConfigMap.

Screenshots (if applicable)

N/A. Manifest-only change.

Breaking Changes

None. Argo CD will prune the old unhashed ConfigMap after the Alloy rollout.

Checklist

• Testing section documents the exact validation performed.
• Screenshots and Breaking Changes sections are handled appropriately.
• Documentation, release notes, and follow-ups are updated or tracked; no documentation change is required for this internal rollout mechanism.