kyverno: force_new on sync-ghcr-credentials — generate rules are immutable

Pipeline 138: the validate-policy webhook denies in-place edits of a
generate rule (allowlist additions). force_new = delete+recreate;
generated secrets survive and generateExisting re-adopts.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

stacks/kyverno/modules/kyverno/ghcr-credentials.tf

@@ -47,6 +47,11 @@ resource "kubernetes_secret" "ghcr_credentials" {
 }
 
 resource "kubectl_manifest" "sync_ghcr_credentials" {
+  # Kyverno's validate-policy webhook DENIES in-place changes to a generate
+  # rule's spec ("changes of immutable fields ... is disallowed"), so any
+  # allowlist edit must delete+recreate the policy. Generated secrets survive
+  # policy deletion; generateExisting re-adopts them on recreate.
+  force_new = true
   yaml_body = yamlencode({
     apiVersion = "kyverno.io/v1"
     kind       = "ClusterPolicy"