docs: update stable baseline to defer ccm/csi

STABLE_BASELINE.md

@@ -12,14 +12,17 @@ This document defines the current engineering target for this repository.
 ## In Scope
 
 - Terraform infrastructure bootstrap
-- Ansible k3s bootstrap
+- Ansible k3s bootstrap (using k3s embedded cloud provider)
 - Flux core reconciliation
-- Hetzner CCM
-- Hetzner CSI
 - External Secrets Operator with Doppler
 - Tailscale private access
 - Observability stack
 
+## Deferred for Later Phases
+
+- Hetzner CCM (using k3s embedded for now)
+- Hetzner CSI (deferred - local storage sufficient for baseline)
+
 ## Out of Scope
 
 - HA control plane
@@ -35,12 +38,12 @@ This document defines the current engineering target for this repository.
 2. k3s server bootstrap completes and kubeconfig works.
 3. Workers join and all nodes are Ready.
 4. Flux source and infrastructure reconciliation are healthy.
-5. CCM is Ready.
-6. CSI is Ready and a PVC can bind.
-7. External Secrets sync required secrets.
-8. Tailscale private access works.
-9. Observability is healthy and reachable privately.
-10. Terraform destroy succeeds cleanly or via workflow retry.
+5. External Secrets sync required secrets.
+6. Tailscale private access works.
+7. Observability is healthy and reachable privately.
+8. Terraform destroy succeeds cleanly or via workflow retry.
+
+_Note: Hetzner CCM and CSI are suspended for the stable baseline phase. Using k3s embedded cloud provider._
 
 ## Success Criteria