tts+kyverno: non-merge apply trigger (merge-commit diff hid stacks/tts from the stack detector)

The Woodpecker default pipeline selects stacks via git diff HEAD~1 HEAD;
on a merge commit that is the first-parent diff, which contained only the
concurrently-landed files — stacks/tts never got applied (namespace still
absent) and the kyverno re-trigger push got no pipeline at all. Single
non-merge commit touching both stacks so the detector sees them; the
sorted loop applies kyverno before tts, the order tripit#26 requires.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

stacks/kyverno/modules/kyverno/resource-governance.tf

@@ -1174,3 +1174,5 @@ resource "kubectl_manifest" "mutate_strip_cpu_limits" {
 # Apply re-trigger 2026-06-11: 87702bdc landed with [ci skip], so this stack was
 # never CI-applied; tripit#26 (tour-guide redo) needs the tts GPU-priority
 # exclusion live before the tts stack applies. No functional change in this commit.
+
+# (See stacks/tts/main.tf — same apply-trigger note, tripit#26.)

stacks/tts/main.tf

@@ -478,3 +478,7 @@ resource "kubernetes_cron_job_v1" "offpeak" {
     ignore_changes = [spec[0].job_template[0].spec[0].template[0].spec[0].dns_config]
   }
 }
+
+# Apply trigger 2026-06-11 (tripit#26): the previous push was a merge commit, so
+# the changed-stack detector (git diff HEAD~1 HEAD = first-parent diff) missed
+# stacks/tts entirely. Non-merge commit so the diff names this stack.