fix(k8s/infra): split infrastructure into controllers and configs stages

ClusterIssuer dry-run fails because cert-manager CRDs are not yet
installed when the single infrastructure Kustomization is applied.
Split into infrastructure-controllers (Helm charts that install CRDs)
and infrastructure-configs (CRD-dependent resources like ClusterIssuer)
with a dependency between them.

kubernetes/infrastructure/controllers/nfs-provisioner/release.yaml

@@ -0,0 +1,24 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: nfs-subdir-external-provisioner
+  namespace: flux-system
+spec:
+  chart:
+    spec:
+      chart: nfs-subdir-external-provisioner
+      version: 4.0.18
+      reconcileStrategy: ChartVersion
+      sourceRef:
+        kind: HelmRepository
+        name: nfs-subdir-external-provisioner
+        namespace: flux-system
+  interval: 1m0s
+  values:
+     nfs:
+        server: synology.lviv
+        path: /volume3/k8s-dev
+     storageClass:
+        name: nfs-synology-ssd
+        defaultClass: false

kubernetes/infrastructure/controllers/nfs-provisioner/repository.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: nfs-subdir-external-provisioner
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  url: https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/