fix(velero): Move Schedules to post-crds

Same CRD-ordering fix as the barman Certificates: Velero Schedule CRs
need velero.io CRDs, which don't exist until the Velero HelmRelease
finishes installing. Moving them into post-crds/ lets the dry-run
succeed on a fresh bootstrap.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

kubernetes/infrastructure/post-crds/kustomization.yaml

@@ -5,4 +5,5 @@ resources:
   - cloudflare-secret.sops.yaml
   - cilium-l2.yaml
   - cnpg-barman-certs.yaml
+  - velero-schedules.yaml
   - ../network-policies/

kubernetes/infrastructure/velero/kustomization.yaml

@@ -3,4 +3,6 @@ kind: Kustomization
 resources:
   - secret.sops.yaml
   - helmrelease.yaml
-  - schedules.yaml
+# Velero Schedule CRs live in kubernetes/infrastructure/post-crds/
+# (velero-schedules.yaml) so they reconcile after the Velero HelmRelease
+# finishes installing velero.io CRDs.