Add kea-operator-ci ServiceAccount for Woodpecker CI

The new kea-operator repo's Woodpecker pipelines run under a dedicated
Kubernetes ServiceAccount that must exist in the woodpecker namespace.

- Add ServiceAccount kea-operator-ci in the woodpecker namespace
- Register it in the woodpecker kustomization resources

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

apps/base/woodpecker/kustomization.yaml

@@ -7,6 +7,7 @@ resources:
   - cnpg_cluster.yaml
   - cnpg_backup.yaml
   - cnpg_pooler.yaml
+  - serviceaccount_kea_operator_ci.yaml
   - serviceaccount_terraform_artifactapi.yaml
   - serviceaccount_terraform_authentik.yaml
   - serviceaccount_terraform_enc.yaml

apps/base/woodpecker/serviceaccount_kea_operator_ci.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kea-operator-ci
+  namespace: woodpecker