feat(atlas): Phase C — live Flux reconcile status on stage 07

Stage 07 now also shows the Flux `apps` Kustomization state — reconciled/failed
+ last-applied revision (main@shortsha) — read in-cluster (new read-only Role in
flux-system). Sits alongside the live deploy node. FluxStatus/FluxNode test-first,
fallback-safe.

Verified: build/vet/lint(0)/test green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/web/handler.go

@@ -56,11 +56,17 @@ func NewHandler() http.Handler {
 				}
 			}
 		}
-		if ld.deploy != nil {
-			node := atlas.DeployNode(*ld.deploy)
+		if ld.deploy != nil || ld.flux != nil {
+			var live []atlas.Node
+			if ld.deploy != nil {
+				live = append(live, atlas.DeployNode(*ld.deploy))
+			}
+			if ld.flux != nil {
+				live = append(live, atlas.FluxNode(*ld.flux))
+			}
 			for i := range a.Stages {
 				if a.Stages[i].Generate == "deploy-state" {
-					a.Stages[i].Nodes = append([]atlas.Node{node}, a.Stages[i].Nodes...)
+					a.Stages[i].Nodes = append(live, a.Stages[i].Nodes...)
 				}
 			}
 		}
@@ -76,6 +82,7 @@ type liveOverlayData struct {
 	ns       string
 	run      *atlas.RunSummary
 	deploy   *atlas.Deploy
+	flux     *atlas.Flux
 	timeline []atlas.RunDot
 }
 
@@ -121,6 +128,11 @@ func liveOverlay() liveOverlayData {
 			d.deploy = &dep
 		}
 	}
+	if raw, err := cluster.FluxKustomization(); err == nil {
+		if f, err := atlas.FluxStatus(raw); err == nil {
+			d.flux = &f
+		}
+	}
 	liveCache = d
 	return d
 }