flux(home-assistant): close cross-KS Secret race + relocate ServiceMonitor

matter-server's seed initContainer mounts garage-migration-creds, owned
by the home-assistant Kustomization. Without an explicit dependsOn the
init container CreateContainerConfigError-loops on a fresh rebuild while
HA is still gated upstream — observed during the 2026-05-05 cold start.

home-assistant's ServiceMonitor consumes a CRD installed by the
kube-prometheus-stack chart (monitoring KS), so applying it from the HA
KS races the CRD on first reconcile. Move it under monitoring-rules,
which already exists for monitoring.coreos.com/* resources after the
chart lands its CRDs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

kubernetes/apps/home-assistant/kustomization.yaml

@@ -8,7 +8,6 @@ resources:
   - service.yaml
   - iot-service.yaml
   - ingress.yaml
-  - servicemonitor.yaml
   - prometheus-token.sops.yaml
   - rbac.yaml
   - mosquitto-bootstrap.yaml

kubernetes/apps/monitoring-rules/kustomization.yaml

@@ -5,3 +5,4 @@ kind: Kustomization
 # only after `monitoring` is Ready (chart installed → CRDs present).
 resources:
   - prometheusrule-garage.yaml
+  - home-assistant-servicemonitor.yaml

kubernetes/clusters/homelab/home-assistant.yaml

@@ -76,6 +76,10 @@ spec:
     - name: infrastructure
     - name: infrastructure-crds
     - name: infrastructure-ceph-cluster
+    # The seed initContainer mounts `garage-migration-creds`, which is owned
+    # by the home-assistant Kustomization. Without this dependency the init
+    # container CreateContainerConfigError-loops until HA's KS lands first.
+    - name: home-assistant
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization