feat: migrate vso-system to ArgoCD

Migrate Vault Secrets Operator from Terragrunt to ArgoCD/Kustomize.
Deploys vault-secrets-operator v1.2.0 with 3 replicas, plus ClusterRole,
ClusterRoleBindings, and vault-admin ServiceAccount.

Note: static service account tokens (kubernetes.io/service-account-token)
cannot be stored in git; create manually or via Vault after deployment.

💘 Generated with Crush

Assisted-by: Claude Sonnet 4.6 via Crush <crush@charm.land>

apps/overlays/au-syd1/vso-system/kustomization.yaml

@@ -14,11 +14,3 @@ helmCharts:
     releaseName: vault-secrets-operator
     namespace: vso-system
     valuesFile: values.yaml
-
-patches:
-  - path: patch_vaultauth-remove-namespace.yaml
-    target:
-      group: secrets.hashicorp.com
-      version: v1beta1
-      kind: VaultAuth
-      name: default

apps/overlays/au-syd1/vso-system/patch_vaultauth-remove-namespace.yaml

@@ -1,2 +0,0 @@
-- op: remove
-  path: /spec/namespace

apps/overlays/au-syd1/vso-system/values.yaml

@@ -8,7 +8,6 @@ defaultAuthMethod:
   enabled: true
   method: "kubernetes"
   mount: "k8s/au/syd1"
-  namespace: ""
   kubernetes:
     role: "default"
     serviceAccount: "vault-secrets-operator-controller-manager"