Reach Headlamp feature parity in the KSail web UI, absorb its plugins, and retire Headlamp from the platform

> 🤖 Generated by the Daily AI Assistant
> Filed on the maintainer's direct direction (2026-07-05).

Cross-repo epic. Platform-side counterpart: the Headlamp-retirement issue on devantler-tech/platform (linked below once filed). Constitution-side counterpart: a monorepo definition PR encoding continuous upstream research into the engineering contract.

## Problem

The platform's Kubernetes UI today is Headlamp plus a set of plugins (flux, cert-manager, keda, opencost, kubescape, crossview). KSail already ships its own web UI (`ksail open web` + ksail-operator), but it is not yet a full replacement, so the platform runs two UIs and KSail misses the chance to be the single, first-class control plane for its own clusters. Long-term direction: **the KSail web UI reaches feature parity with Headlamp, absorbs the plugin capabilities, and Headlamp is removed from the platform.**

## Proposed direction

1. **Parity audit (first child):** inventory Headlamp core capabilities (resource browsing/editing, logs, exec, port-forward, multi-cluster, OIDC auth) and each platform-installed plugin's capabilities (flux 0.6.0, cert-manager 0.1.0, keda 0.1.1-beta, opencost 0.1.3, kubescape 0.11.2, crossview-headlamp 0.1.4) against the current KSail web UI — produce a gap matrix with a per-capability size estimate, and decide which gaps are must-have for retirement vs deliberately out of scope.
2. **Parity slices:** close the gaps oldest/highest-value-first as independently-shippable children (one capability domain per child: GitOps/Flux view, security posture (Kubescape), cost (OpenCost), autoscaling (KEDA), certificates (cert-manager), Crossplane graph (Crossview), plus any core-UX gaps).
3. **Migration + retirement gate:** when the matrix's must-haves are green, the platform switches (remove Headlamp app + plugins + its SSO wiring) — tracked by the platform-side issue; KSail docs absorb the operator-UI guidance.
4. **Continuous upstream research (standing):** on a recurring cadence, research new features and capabilities in Headlamp, ArgoCD, FluxCD, and KSail's other upstream dependencies, and convert findings into well-formed issues so KSail and the platform stay at parity with upstream state of the art (features, code quality, performance, reliability, UI and UX). The engineering-contract change that makes this a standing motion when the backlog runs empty ships separately as a monorepo definition PR.

## Acceptance criteria

- [ ] Gap matrix issue (child 1) filed and resolved with a maintainer-visible parity decision per capability
- [ ] Each must-have gap closed via its own child issue/PR in KSail
- [ ] Platform retirement issue unblocked and executed (Headlamp removed from the platform)
- [ ] Upstream-research findings from Headlamp/ArgoCD/FluxCD land as issues on a recurring cadence

Rough size: XL (multi-month, decomposed into children; the epic tracks direction, children carry the work).

Start with the `ksail open web` entry point and the ksail-operator web UI, then inventory the Headlamp capabilities and listed plugins against the current UI. Produce the gap matrix and file child issues for must-have gaps; done means the matrix has maintainer-visible decisions and each required capability has its own tracked implementation path.

Written by the indexing model from the issue text.