Fix ArgoCD ServerSideDiff permanent OutOfSync diffs

Add explicit CRD/API defaults to manifests that were causing ArgoCD's
SSA dry-run to produce results different from live state:

- HTTPRoutes: add group, kind, weight defaults to parentRefs/backendRefs
- Kyverno ClusterPolicies: add skipBackgroundRequests, allowExistingViolations
- Tetragon TracingPolicies: add return, maxData, resolve, returnCopy defaults
- Gateway certificateRefs: add group="" default
- Guacamole Gateway: add group="" to certificateRefs

Add ignoreDifferences for resources that legitimately differ:
- Cilium cert Secrets (auto-generated, data always differs)
- Istio ValidatingWebhookConfiguration failurePolicy (istiod mutates)
- Crowdsec LAPI Secrets (randomly generated)
- ServiceMonitor/PodMonitor relabeling action defaults
- StatefulSet volumeClaimTemplates apiVersion/kind defaults

Persist argocd-cm ignoreDifferences config in ArgoCD Helm values.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infrastructure/kyverno/policies/restrict-image-registries.yaml

@@ -16,6 +16,7 @@ spec:
   background: true
   rules:
     - name: validate-container-registries
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -29,6 +30,7 @@ spec:
                 - kube-node-lease
                 - kyverno
       validate:
+        allowExistingViolations: true
         message: >-
           Images must come from allowed registries: docker.io, ghcr.io, quay.io,
           registry.k8s.io, gcr.io, lscr.io, registry.gitlab.com, cr.fluentbit.io,