uralkal: drift detection для всех HelmRelease (п.39, INFRA-3058)

driftDetection.mode: enabled патчем в clusters/uralkal/kustomization.yaml,
base и другие контуры не затронуты. Исключены webhooks в
Mutating/ValidatingWebhookConfiguration (caBundle пишут vault-injector и
istiod) и /spec/replicas Deployment у istiod (HPA istio-system/istiod).
Kustomization flux-system уже prune: true, interval: 10m.

clusters/uralkal/kustomization.yaml

@@ -55,3 +55,29 @@ resources:
   - ../../apps/message-hub/uralkal
   - ../../apps/cde/uralkal
 
+patches:
+  - target:
+      kind: HelmRelease
+    patch: |
+      - op: add
+        path: /spec/driftDetection
+        value:
+          mode: enabled
+          ignore:
+            - paths: ["/webhooks"]
+              target:
+                kind: MutatingWebhookConfiguration
+            - paths: ["/webhooks"]
+              target:
+                kind: ValidatingWebhookConfiguration
+  - target:
+      kind: HelmRelease
+      name: istiod
+    patch: |
+      - op: add
+        path: /spec/driftDetection/ignore/-
+        value:
+          paths: ["/spec/replicas"]
+          target:
+            kind: Deployment
+