Fix Kyverno OSD policy init container ordering

Use patchesJson6902 with append (/-) for create-block-db-symlink to
ensure it runs after activate, not before. The patchStrategicMerge was
inserting it before activate, causing prime-osd-dir to clear the symlink.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infrastructure/kyverno/policies/fix-rook-osd-metadata-device.yaml

@@ -13,7 +13,7 @@ metadata:
 spec:
   background: false
   rules:
-    - name: fix-osd-init-containers
+    - name: noop-expand-bluefs
       match:
         any:
           - resources:
@@ -33,7 +33,23 @@ spec:
                   - name: expand-bluefs
                     command: ["/bin/true"]
                     args: []
-                  - name: create-block-db-symlink
+    - name: add-block-db-symlink
+      match:
+        any:
+          - resources:
+              kinds:
+                - Deployment
+              namespaces:
+                - rook-ceph
+              selector:
+                matchLabels:
+                  app: rook-ceph-osd
+      mutate:
+        patchesJson6902: |-
+          - op: add
+            path: /spec/template/spec/initContainers/-
+            value:
+              name: create-block-db-symlink
               image: quay.io/ceph/ceph:v19.2.0
               command: ["/bin/bash", "-c"]
               args: