[multi] Sweep Kyverno wait-for redis annotations to redis-master

Replaces `redis.redis:6379` with `redis-master.redis:6379` in all 11
dependency.kyverno.io/wait-for annotations across 8 stacks, plus one
docs comment in the Kyverno module.

These annotations drive DNS-only `nc -z` init-container readiness
checks — zero RW risk. Both hostnames resolve, so there is no wait-for
failure window during the rolling re-apply.

Closes: code-otr

stacks/affine/main.tf

@@ -201,7 +201,7 @@ resource "kubernetes_deployment" "affine" {
         annotations = {
           "diun.enable"                    = "true"
           "diun.include_tags"              = "^\\d+\\.\\d+\\.\\d+$"
-          "dependency.kyverno.io/wait-for" = "postgresql.dbaas:5432,redis.redis:6379"
+          "dependency.kyverno.io/wait-for" = "postgresql.dbaas:5432,redis-master.redis:6379"
         }
       }
       spec {