fix(apps): semaphore SEMAPHORE_PORT — shadow kubelet service-link injection

With the config PVC now writable (fsGroup), semaphore got past config write and
pinged its PostgreSQL successfully, then crashed on:
  panic: value of field 'Port' is not valid: tcp://<svcIP>:3000

Because the Service is named `semaphore`, the kubelet injects the Docker-link-style
SEMAPHORE_PORT=tcp://<clusterIP>:3000, which collides with Semaphore's OWN
SEMAPHORE_PORT (its HTTP listen port). Add an explicit SEMAPHORE_PORT=":3000" env
entry — user-defined env takes precedence over service-link vars — pinning the
listen port back to :3000 (matches containerPort/Service). Uses the existing env
field; only apps/semaphore.yaml changes, all others byte-identical.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

apps/semaphore.yaml

@@ -116,6 +116,8 @@ spec:
             secretKeyRef:
               name: semaphore-bootstrap
               key: access-key-encryption
+        - name: SEMAPHORE_PORT
+          value: :3000
         volumeMounts:
         - name: config
           mountPath: /etc/semaphore