Add query-log writer deployment manifests

[bill-ph]

Summary

• add disabled-by-default query-log writer Deployment, metrics Service, and example Kafka ConfigMap
• wire optional DUCKGRES_QUERY_LOG_* env from the example ConfigMap into local, kind, and e2e control-plane manifests
• add writer RBAC and network policy, a basic PrometheusRule example, and README runbook and rollback notes

Tests

• go test ./tests/manifests
• just test-unit
• just lint

[github-actions]

Test Impact Plan

Deterministic summary of how this PR changes tests, CI runners, and coverage-risk signals.

Summary

Area	Added	Changed	Deleted
Test files	1	2	0
E2E/journey files	0	1	0
Workflow files	0	0	0

Signals

• Test cases: +9 / -0
• Assertions: +16 / -0
• Skips or known failures added: 0
• Workflow continue-on-error added: 0
• Workflow path filters added: 0
• Test commands removed from justfile: 2
• E2E/journey retry lines added: 0

Coverage risk: likely reduced

Warnings

• Test command removed (likely reduced)
  • 2 test command line(s) removed from justfile
• E2E or journey files changed (needs review)
  • tests/e2e-mw-dev/manifests.tmpl.yaml