fix(kyverno): raise admission-controller resources + dev replicas 2 to stop fail-closed crashloop/502s

Admission controller was crashlooping (9 restarts/4h, exit 255, NOT OOM:
live usage ~65Mi/384Mi limit, 7m cpu). Root cause: chart-default 100m CPU
request starved the process under node contention, so client-go calls hit
context-deadline-exceeded, leader-election lease renewal timed out, leadership
was lost and the webhook server closed. Raise the CPU request to 250m (no CPU
limit, to avoid CFS throttling) with modest memory headroom (256Mi/512Mi), and
raise dev admission replicas 1->2 so a single fail-closed pod restart no longer
502s cluster-wide admission-gated writes.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

clusters/dev/kustomization.yaml

@@ -104,6 +104,9 @@ patches:
       - op: replace
         path: /data/KYVERNO_FORCE_FAILURE_POLICY_IGNORE
         value: "true"
+      # 2 (not base-default 1): the webhook is fail-closed, so a single-pod restart 502s every
+      # admission-gated write cluster-wide. Two replicas give a fail-closed webhook availability
+      # headroom during a restart/upgrade while staying dev-modest (prod runs 3).
       - op: replace
         path: /data/KYVERNO_ADMISSION_REPLICAS
-        value: "1"
+        value: "2"