fix(kyverno): correct chart webhook schema (map + forceFailurePolicyIgnore)

Kyverno HelmRelease install failed at Helm templating: config.webhooks was a
LIST [{failurePolicy, namespaceSelector}], but the kyverno 3.3.9 chart expects
config.webhooks to be a MAP (webhooks.namespaceSelector) — the chart helper reads
.namespaceSelector off the value directly ('can't evaluate field namespaceSelector
in type []interface {}'). Also, failurePolicy is not a per-webhook field here; the
chart's global switch is config.forceFailurePolicyIgnore.enabled (bool).

Fix: config.webhooks -> map with namespaceSelector (system+platform excludes);
add config.forceFailurePolicyIgnore.enabled = ${KYVERNO_FORCE_FAILURE_POLICY_IGNORE}.
Renamed the cluster-var KYVERNO_WEBHOOK_FAILURE_POLICY (Fail/Ignore) ->
KYVERNO_FORCE_FAILURE_POLICY_IGNORE (false base / true dev). Verified with
helm template (renders 73 objects, no error); gate PASS.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

clusters/base/cluster-vars.yaml

@@ -31,9 +31,9 @@ data:
   # --- admission enforcement (Kyverno, ADR-0011). Base defaults are the STRICT/prod posture;
   #     the dev overlay softens them for bootstrap (Audit / Ignore / 1) so a cold cluster can
   #     come up before policies are proven and admission is HA. ---
-  KYVERNO_VALIDATION_ACTION: "Enforce"      # dev: Audit (observe before enforcing)
-  KYVERNO_WEBHOOK_FAILURE_POLICY: "Fail"    # dev: Ignore (fail-open during bootstrap)
-  KYVERNO_ADMISSION_REPLICAS: "3"           # dev: 1 (no HA needed to iterate)
+  KYVERNO_VALIDATION_ACTION: "Enforce"            # dev: Audit (observe before enforcing)
+  KYVERNO_FORCE_FAILURE_POLICY_IGNORE: "false"    # dev: "true" (chart forceFailurePolicyIgnore = fail-open)
+  KYVERNO_ADMISSION_REPLICAS: "3"                 # dev: 1 (no HA needed to iterate)
 
   # --- identity / auth (ADR-0014) ---
   KEYCLOAK_REPLICAS: "1"                     # dev 1 | prod 2 (HA)