feat: migrate vso-system to ArgoCD (#81)

Migrate Vault Secrets Operator from Terragrunt to ArgoCD/Kustomize.
Deploys vault-secrets-operator v1.2.0 with 3 replicas, plus ClusterRole,
ClusterRoleBindings, and vault-admin ServiceAccount.

Note: static service account tokens (kubernetes.io/service-account-token)
cannot be stored in git; create manually or via Vault after deployment.

💘 Generated with Crush

Assisted-by: Claude Sonnet 4.6 via Crush <crush@charm.land>

Reviewed-on: #81

argocd/applicationsets/platform.yaml

@@ -25,6 +25,7 @@ spec:
       - path: apps/overlays/*/reloader-system
       - path: apps/overlays/*/reposync
       - path: apps/overlays/*/vm-system
+      - path: apps/overlays/*/vso-system
       - path: apps/overlays/*/woodpecker
   template:
     metadata:

argocd/projects/platform.yaml

@@ -11,6 +11,7 @@ spec:
     - https://charts.jetstack.io
     - https://cloudnative-pg.github.io/charts
     - https://helm.elastic.co
+    - https://helm.releases.hashicorp.com
     - https://intel.github.io/helm-charts/
     - https://kubernetes-sigs.github.io/external-dns/
     - https://releases.rancher.com/server-charts/stable