fix(k8s/infra): split infrastructure into controllers and configs stages

ClusterIssuer dry-run fails because cert-manager CRDs are not yet
installed when the single infrastructure Kustomization is applied.
Split into infrastructure-controllers (Helm charts that install CRDs)
and infrastructure-configs (CRD-dependent resources like ClusterIssuer)
with a dependency between them.

kubernetes/app/ks.yaml

@@ -12,7 +12,7 @@ spec:
     kind: GitRepository
     name: flux-system
   dependsOn:
-    - name: infrastructure
+    - name: infrastructure-configs
     - name: config
   decryption:
     provider: sops

kubernetes/infrastructure/ks.yaml

@@ -2,11 +2,11 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: infrastructure
+  name: infrastructure-controllers
   namespace: flux-system
 spec:
   interval: 10m
-  path: ./kubernetes/infrastructure
+  path: ./kubernetes/infrastructure/controllers
   prune: true
   sourceRef:
     kind: GitRepository
@@ -21,3 +21,26 @@ spec:
     substituteFrom:
     - kind: Secret
       name: cluster-vars
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: infrastructure-configs
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./kubernetes/infrastructure/configs
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  dependsOn:
+    - name: infrastructure-controllers
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  postBuild:
+    substituteFrom:
+    - kind: Secret
+      name: cluster-vars