pkgatlas(kube): deploy

Flux HelmRelease tracking the CI-published chart (>=0.4.0-0, timestamped
versions, appVersion pinned to the image commit). Ingress host
pkgatlas.vhaudiquet.fr via traefik; TLS terminates at Caddy with the
*.vhaudiquet.fr wildcard, so the new @pkgatlas route proxies to Traefik
like the other public vhosts.

kubernetes/dev/pkgatlas/kustomizeconfig.yaml

@@ -0,0 +1,6 @@
+nameReference:
+- kind: Secret
+  version: v1
+  fieldSpecs:
+  - path: spec/valuesFrom/name
+    kind: HelmRelease