feat(apps): onboard pihole via renderer + --no-image-automation flag (WS-APPS golden path)

First app onboarded through catalog/render.py -> apps/. Added --no-image-automation so apps
deploy before the Flux image controllers exist (L1 goldens keep the default, unchanged).
KNOWN GAP surfaced: exposed apps get default-deny (ingress: []) with no gateway-ingress allow,
so the HTTPRoute path is blocked — renderer/WS-NET follow-up to allow Cilium gateway ingress
to services with an exposure/HTTPRoute.

apps/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+# Onboarded services (WS-APPS). Each app is rendered from its catalog/ ServiceDefinition by
+# catalog/render.py and committed here; the `apps` Flux Kustomization (clusters/base/apps.yaml,
+# dependsOn platform-config) reconciles this directory. Image-automation CRs are omitted for now
+# (--no-image-automation) until the Flux image controllers are installed.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - pihole.yaml