fix(kyverno): correct chart webhook schema (map + forceFailurePolicyIgnore)

Kyverno HelmRelease install failed at Helm templating: config.webhooks was a
LIST [{failurePolicy, namespaceSelector}], but the kyverno 3.3.9 chart expects
config.webhooks to be a MAP (webhooks.namespaceSelector) — the chart helper reads
.namespaceSelector off the value directly ('can't evaluate field namespaceSelector
in type []interface {}'). Also, failurePolicy is not a per-webhook field here; the
chart's global switch is config.forceFailurePolicyIgnore.enabled (bool).

Fix: config.webhooks -> map with namespaceSelector (system+platform excludes);
add config.forceFailurePolicyIgnore.enabled = ${KYVERNO_FORCE_FAILURE_POLICY_IGNORE}.
Renamed the cluster-var KYVERNO_WEBHOOK_FAILURE_POLICY (Fail/Ignore) ->
KYVERNO_FORCE_FAILURE_POLICY_IGNORE (false base / true dev). Verified with
helm template (renders 73 objects, no error); gate PASS.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

clusters/dev/kustomization.yaml

@@ -91,8 +91,8 @@ patches:
         path: /data/KYVERNO_VALIDATION_ACTION
         value: "Audit"
       - op: replace
-        path: /data/KYVERNO_WEBHOOK_FAILURE_POLICY
-        value: "Ignore"
+        path: /data/KYVERNO_FORCE_FAILURE_POLICY_IGNORE
+        value: "true"
       - op: replace
         path: /data/KYVERNO_ADMISSION_REPLICAS
         value: "1"