docs(monitoring): record the live series counts the rule was checked against

Comment-only. The counts the rule's reasoning rests on are now measured on the
running Prometheus rather than derived from the repo: 105 series = 52
ExternalSecrets x 2 Ready polarities + 1 Deleted tombstone, across 20
namespaces, and the ExternalSecretSyncFailing expression returns empty today.
The last point is the one a reviewer wants: the rule arrives silent.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

kubernetes/apps/monitoring-rules/prometheusrule-external-secrets.yaml

@@ -63,6 +63,21 @@ spec:
   groups:
     - name: external-secrets.rules
       rules:
+        # Measured against the live Prometheus before this rule was proposed for
+        # merge, through the apiserver services/proxy read path:
+        #
+        #   count(externalsecret_status_condition)                       = 105
+        #   count(count by (exported_namespace,name) (...))              =  53
+        #   count(count by (exported_namespace,name) (...{condition="Ready"})) = 52
+        #   count(count by (exported_namespace) (...))                   =  20
+        #   count(...{condition="Ready",status="False"})                 =  52
+        #   the ExternalSecretSyncFailing expression below                = EMPTY
+        #
+        # So 105 = 52 ExternalSecrets x 2 Ready polarities + 1 Deleted tombstone,
+        # across 20 namespaces, and THIS RULE ARRIVES SILENT: it matches nothing
+        # in the cluster as it stands, which is what makes it safe to load. The
+        # 52 on the line below is a count, not an estimate.
+        #
         # `== 1` IS LOAD-BEARING, not defensive. ESO writes BOTH polarities of the
         # Ready condition on every reconcile — the true one at 1 and the opposite
         # at 0 (esmetrics.UpdateExternalSecretCondition) — so