fix(ingress): gate tenants-default-retry middleware on values flag (B.11)

values.yaml

@@ -153,3 +153,12 @@ ingress:
   # See infrastructure/cluster/wildcard-cert.yaml for the
   # provisioning manifest.
   tlsSecret: tenants-wildcard-tls
+  # useTenantsDefaults — when true, the IngressRoute references the
+  # cluster-level `tenants-default-retry` Middleware (rendered by the
+  # cluster-platform-v3 chart in the same `tenants` namespace).
+  # Default true matches the standard platform shape; flip to false
+  # only when running on a cluster whose Traefik install isn't
+  # paired with the platform's defaults Middleware set (e.g. an
+  # externally-managed Traefik, or cluster-platform-v3's
+  # `traefik.enabled` is false). Audit B.11.
+  useTenantsDefaults: true