fix(flux): infrastructure is Ready only once OpenBao is unsealed

The infrastructure Kustomization health-checked the openbao HelmRelease,
which is Ready as soon as the chart is installed, sealed or not. On a cold
cluster infrastructure-crds then applied the openbao ClusterSecretStore
while OpenBao was unreachable and then sealed ("503 Vault is sealed").
External Secrets backs the store off exponentially, so every
ExternalSecret stayed "ClusterSecretStore not ready" for minutes after
OpenBao was restored and unsealed; Velero's pod could not mount
cloud-credentials-hetzner meanwhile (restore rehearsal run 27; ~15 min in
run 22).

The openbao StatefulSet is now a health check too. Its readiness probe is
`bao status`, which fails while sealed, and podManagementPolicy is
OrderedReady, so 3/3 ready means every replica is unsealed. No cycle:
OpenBao's PVC comes from infrastructure-ceph-cluster, which does not
depend on infrastructure.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kubernetes/clusters/homelab/infrastructure.yaml

@@ -40,6 +40,13 @@ spec:
       kind: HelmRelease
       name: openbao # the ESO backend ExternalSecrets resolve against
       namespace: openbao
+    # Ready only when every replica is unsealed (readiness probe: bao status).
+    # The HelmRelease is Ready as soon as the chart is installed; the
+    # ClusterSecretStore in infrastructure-crds must not come up before.
+    - apiVersion: apps/v1
+      kind: StatefulSet
+      name: openbao
+      namespace: openbao
     - apiVersion: helm.toolkit.fluxcd.io/v2
       kind: HelmRelease
       name: rook-ceph-operator # storage — apps mount PVCs