security-audit: drop flux-system read polling from apiserver audit pipeline

filter/audit in audit-collector drops get/list/watch events from
system:serviceaccount:flux-system:* (helm/kustomize/source controllers polling
fluxcd resources every few seconds — the bulk of the topic volume). GitOps
mutations are kept: they are the actual trail of cluster changes.

infrastructure/security-audit/base/helmrelease-collector.yaml

@@ -152,6 +152,15 @@ spec:
           check_interval: 1s
           limit_mib: 400
           spike_limit_mib: 100
+        # Отрезание шума до transform и Kafka: бесконечные опросы Flux-контроллеров
+        # (helm/kustomize/source: get/list/watch на ресурсах fluxcd). Мутации GitOps
+        # (create/update/patch/delete) остаются — они и есть след изменений через GitOps.
+        # Фильтр намеренно узкий: чтения других акторов (kube-system, операторы) не трогаем.
+        filter/audit:
+          error_mode: ignore
+          logs:
+            log_records:
+              - 'IsMatch(body["user"]["username"], "^system:serviceaccount:flux-system:") and (body["verb"] == "get" or body["verb"] == "list" or body["verb"] == "watch")'
         transform/audit:
           error_mode: ignore
           log_statements:
@@ -228,7 +237,7 @@ spec:
         pipelines:
           logs/audit:
             receivers: [filelog/audit]
-            processors: [memory_limiter, transform/audit, batch]
+            processors: [memory_limiter, filter/audit, transform/audit, batch]
             exporters: [kafka/audit]
         telemetry:
           logs: