puppetdb: isolate only the stockpile queue per pod, not the whole vardir

PR #340 made the entire vardir (/opt/puppetlabs/server/data/puppetdb)
per-pod via subPathExpr. That also isolated the SSL keypair under
vardir/certs, so freshly-rolled pods had an empty certs dir and crashed:
"No keypair on disk and CA already has signed certificate for openvoxdb"
(all pods share certname openvoxdb). puppetdb went CrashLoopBackOff.

Keep the vardir shared (certs + logs as before) and make only the
command queue per-pod: nest-mount the same PVC at vardir/stockpile with
subPathExpr stockpile/$(POD_NAME). The init container pre-creates and
chowns the per-pod stockpile dir.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

apps/base/puppet/deployment_puppetdb.yaml

@@ -92,7 +92,9 @@ spec:
           volumeMounts:
             - mountPath: /opt/puppetlabs/server/data/puppetdb
               name: puppetdb-storage
-              subPathExpr: $(POD_NAME)
+            - mountPath: /opt/puppetlabs/server/data/puppetdb/stockpile
+              name: puppetdb-storage
+              subPathExpr: stockpile/$(POD_NAME)
             - mountPath: /etc/puppetlabs/puppetdb/conf.d/read-database.conf
               name: puppetdb-read-database-conf
               subPath: read-database.conf
@@ -103,7 +105,7 @@ spec:
             - sh
             - -c
           args:
-            - mkdir -p /opt/puppetlabs/server/data/puppetdb/logs && chown 999:999 /opt/puppetlabs/server/data/puppetdb/logs
+            - mkdir -p /opt/puppetlabs/server/data/puppetdb/logs /opt/puppetlabs/server/data/puppetdb/stockpile && chown 999:999 /opt/puppetlabs/server/data/puppetdb/logs /opt/puppetlabs/server/data/puppetdb/stockpile
           env:
             - name: POD_NAME
               valueFrom:
@@ -121,7 +123,9 @@ spec:
           volumeMounts:
             - mountPath: /opt/puppetlabs/server/data/puppetdb
               name: puppetdb-storage
-              subPathExpr: $(POD_NAME)
+            - mountPath: /opt/puppetlabs/server/data/puppetdb/stockpile
+              name: puppetdb-storage
+              subPathExpr: stockpile/$(POD_NAME)
 
         - name: pgchecker
           image: docker.io/busybox:1.37