PM integration: wire platform/kyverno into the platform render

Add platform/kyverno/kustomization.yaml (renders the admission enforcing bundle)
and enable the kyverno component in platform/kustomization.yaml (first, so
admission policies precede other components). kustomize build verified.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/kustomization.yaml

@@ -11,7 +11,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  # - kyverno            # TODO(PM): enable when the policy engineer's kyverno stub lands (WS-TEST)
+  - kyverno              # PM: enabled — admission enforcer first so policies precede other components
   - cilium
   - longhorn
   - cert-manager