feat(monitoring): alert when the keycloak passkey reconciler's Job fails

KeycloakPasskeyReconcilerFailing (warning, for 15m) on
kube_job_status_failed{namespace="keycloak", job_name=~"keycloak-passkey-reconciler-.*"},
following the sibling client-secret reconciler's rule. promtool unit tests pin it in
both directions: quiet when succeeding, firing after 15m on a failed Job, quiet on the
SIBLING's failure, and quiet on a single transient failure. Runbook added and projected
by the runbooks ConfigMap generator.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

runbooks/kustomization.yaml

@@ -77,6 +77,7 @@ configMapGenerator:
       - image-automation=image-automation.md
       - image-policy-stalled=image-policy-stalled.md
       - keycloak-client-secrets=keycloak-client-secrets.md
+      - keycloak-passkey-reconciler=keycloak-passkey-reconciler.md
       - keycloak-db=keycloak-db.md
       - keycloak-down=keycloak-down.md
       - kubevirt-control-plane=kubevirt-control-plane.md