kyverno(kube): fix deployment

kubernetes/system/kyverno/kustomization.yaml

@@ -1,4 +1,11 @@
 ---
+# Kyverno controller + CRDs only.
+# The ClusterPolicy lives in a SEPARATE directory (kubernetes/system/kyverno-policies)
+# applied by a SEPARATE Flux Kustomization (kyverno-policies) with dependsOn:
+# kyverno. This split is required because Flux dry-runs every resource in a
+# Kustomization before applying any of them — the ClusterPolicy references the
+# kyverno.io/v2 CRD, which does not exist until this HelmRelease installs it, so
+# bundling them together makes the whole Kustomization fail at dry-run.
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: kyverno
@@ -6,8 +13,5 @@ resources:
   - namespace.yaml
   - repository.yaml
   - release.yaml
-  # ClusterPolicy that strips CPU requests for emergency relief (toggleable).
-  # See policy-strip-cpu-requests.yaml header for the toggle instructions.
-  - policy-strip-cpu-requests.yaml
 configurations:
   - kustomizeconfig.yaml