fix(k8s/infra): split infrastructure into controllers and configs stages

ClusterIssuer dry-run fails because cert-manager CRDs are not yet
installed when the single infrastructure Kustomization is applied.
Split into infrastructure-controllers (Helm charts that install CRDs)
and infrastructure-configs (CRD-dependent resources like ClusterIssuer)
with a dependency between them.

kubernetes/app/ks.yaml

@@ -12,7 +12,7 @@ spec:
     kind: GitRepository
     name: flux-system
   dependsOn:
-    - name: infrastructure
+    - name: infrastructure-configs
     - name: config
   decryption:
     provider: sops