fix: resolve cert-manager CRD dependency for cluster redeployability

- Add root kustomization.yaml to explicitly list included paths
- Exclude cert-manager and cert-manager-issuer from root kustomization
- Add Flux Kustomizations in system/flux/ to manage deployment order
- cert-manager Flux Kustomization includes health checks for CRDs
- cert-manager-issuer depends on cert-manager being ready

kubernetes/system/cert-manager-issuer/kustomization.yaml

@@ -0,0 +1,5 @@
+# ClusterIssuer resources for cert-manager
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - clusterissuer.yaml