Ignore defaulted StatefulSet volumeClaimTemplates TypeMeta

Kubernetes defaults apiVersion=v1 and kind=PersistentVolumeClaim onto every
StatefulSet volumeClaimTemplates entry, but neither the raw manifests nor the
rendered helm charts emit those fields. Live StatefulSets therefore carry
TypeMeta that git lacks, and ArgoCD reports a diff removing it. Because
volumeClaimTemplates are immutable on an existing StatefulSet, ArgoCD can never
apply the removal, so consul-server, kanidm and nats stay perpetually OutOfSync
and can contribute to sync failures.

Add a fleet-wide resource.customizations.ignoreDifferences for apps/StatefulSet
that ignores the defaulted apiVersion/kind under every volumeClaimTemplates
entry. A single global customization covers the affected StatefulSets across
both raw manifests (kanidm) and helm renders (consul, nats), and is inert for
those whose charts already emit TypeMeta (vault, woodpecker).

clusters/au-syd1/bootstrap/argocd-cm-patch.yaml

@@ -6,6 +6,16 @@ metadata:
   namespace: argocd
 data:
   kustomize.buildOptions: "--enable-helm"
+  # Kubernetes defaults apiVersion/kind onto every StatefulSet
+  # volumeClaimTemplates entry, but neither the raw manifests nor the helm
+  # charts emit them, so live StatefulSets carry TypeMeta that git lacks.
+  # volumeClaimTemplates are immutable on an existing StatefulSet, so ArgoCD
+  # can never reconcile the removal and the resource stays perpetually
+  # OutOfSync. Ignore the defaulted TypeMeta fleet-wide.
+  resource.customizations.ignoreDifferences.apps_StatefulSet: |
+    jqPathExpressions:
+      - '.spec.volumeClaimTemplates[]?.apiVersion'
+      - '.spec.volumeClaimTemplates[]?.kind'
   # External URL ArgoCD serves on (TLS terminated at the traefik-internal gateway).
   url: https://argocd.k8s.syd1.au.unkin.net
   # OIDC login via Authentik. The client secret is seeded in Vault out of band