feat(foundry): route /api/org/* to sentinel core

[BK1031]

Sentinel adds an org chart under /org — GET /org/positions, the composed GET /org/chart, and the admin CRUD. Without a gateway route those paths fall through to the web upstream, so the SPA answers API calls with index.html and a 200 instead of a 404.

• Add a core-org route for /api/org/* to the kerbecs ConfigMap, placed after core-analytics to match the compose config in the Sentinel repo

Pairs with Gaucho-Racing/Sentinel#147.

Rollout

• kerbecs runs with providers.static.watch: true (and is pinned to 3.2.0, past the 3.1.0 that added the watcher), so this applies on the ConfigMap update — no pod restart needed
• The route is inert until sentinel-core ships the endpoints, so it is safe to land ahead of the version bump. Landing it after would mean /api/org/* briefly returns the SPA shell instead of data

Testing

• kubectl kustomize kubernetes/gr-foundry/manifests/sentinel renders cleanly; the rendered ConfigMap carries 18 routes including core-org, with watch: true intact
• Parsed the embedded kerbecs.yaml and diffed it against the Sentinel repo's compose config: route names and order now match exactly, and the core-org block is identical
• Confirmed the core upstream exists and that no earlier route prefix shadows /api/org/*