feat: migrate vso-system to ArgoCD (#81)

Migrate Vault Secrets Operator from Terragrunt to ArgoCD/Kustomize.
Deploys vault-secrets-operator v1.2.0 with 3 replicas, plus ClusterRole,
ClusterRoleBindings, and vault-admin ServiceAccount.

Note: static service account tokens (kubernetes.io/service-account-token)
cannot be stored in git; create manually or via Vault after deployment.

💘 Generated with Crush

Assisted-by: Claude Sonnet 4.6 via Crush <crush@charm.land>

Reviewed-on: #81

argocd/applicationsets/platform.yaml

@@ -25,6 +25,7 @@ spec:
       - path: apps/overlays/*/reloader-system
       - path: apps/overlays/*/reposync
       - path: apps/overlays/*/vm-system
+      - path: apps/overlays/*/vso-system
       - path: apps/overlays/*/woodpecker
   template:
     metadata: