fix(kyverno): auto-vpa must exclude the system namespaces explicitly before the resource filters drop #4231

🤖 Generated by the Agentic Engineer

Evidence

• Option 1 in security(kyverno): system namespaces have had no Kyverno policy coverage since June #4228 removes the system-namespace entries from Kyverno's resource filters. Its first step is to check which background-capable policies would start acting in kube-system, kube-public, kube-node-lease and kyverno.
• I read the kustomize patches on main. add-ns-quota already excludes those namespaces. insert-pod-antiaffinity and spread-pods exclude kube-system, and they are admission-only mutations. The admission webhooks' namespaceSelector already keeps kube-system and kyverno out, and kube-public and kube-node-lease hold no Deployments or StatefulSets.
• auto-vpa excludes nothing. It relies on the resource filters alone (its own header says so). In prod the hetzner overlay ships Flux-owned static VPAs in kube-system and kyverno with the same names the policy would generate. If the filters dropped, a generated VPA (synchronize: true) and Flux would keep overwriting the same object.

Smallest useful change

Give each of auto-vpa's three rules an explicit exclusion of the four system namespaces. The change does nothing today, because the filters still hide those namespaces. After it, removing the filter entries cannot change auto-vpa.

Acceptance criteria

• kyverno apply of the policy against probe workloads in kube-system, kyverno and default generates a VPA only for default. The policy on main generates all of them.
• ksail workload validate passes for both overlays.