fix(vms): drop postBuild substituteFrom on apps-vms — it corrupted VM cloud-init

Flux's postBuild.substituteFrom runs envsubst over the WHOLE manifest, including
the VM cloud-init userData. It was substituting every shell `${...}` in the UOS
install script (${UOS_URL}, the API-resolver ${...}) to empty — which is why the
first UOS install silently did nothing — and ${PIPESTATUS[0]} then broke the
build entirely ("missing closing brace"), blocking apps-vms reconcile.

VM manifests use no cluster-vars, so substitution is unneeded. Removed it; the
cloud-init shell now reaches the guest intact. (A future VM needing a cluster-var
must escape its shell `${...}` as `$${...}`.)

Co-Authored-By: Claude Opus 4.8 <[email protected]>

clusters/base/apps-vms.yaml

@@ -23,7 +23,7 @@ spec:
     kind: GitRepository
     name: flux-system
   path: ./apps/vms
-  postBuild:
-    substituteFrom:
-      - kind: ConfigMap
-        name: cluster-vars
+  # NO postBuild.substituteFrom: Flux's envsubst would run over the ENTIRE manifest, including the
+  # VM cloud-init shell scripts, and mangle every `${...}` (e.g. ${UOS_URL}, ${PIPESTATUS[0]}) —
+  # corrupting the in-guest install. VM manifests reference no cluster-vars, so substitution is
+  # unneeded here. A future VM that needs a cluster-var must escape its shell `${...}` as `$${...}`.