Add Kyverno PolicyExceptions for third-party charts

ArgoCD, NetBird operator, and Scylla Manager are upstream Helm charts
that don't set resource limits, probes, drop-all capabilities, or
disable SA token automount. These audit-mode policy violations inflated
the cumulative Prometheus failure counter to ~3800.

- argocd: exempt from require-resource-limits, require-probes
- netbird-operator: exempt from require-resource-limits,
  disallow-automount-sa-token, require-probes
- scylla-manager: exempt from require-drop-all-capabilities,
  disallow-automount-sa-token

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infrastructure/kyverno/policies/scylla-exception.yaml

@@ -0,0 +1,27 @@
+# Scylla Manager and ScyllaDB upstream charts do not drop all
+# capabilities and automount the SA token for cluster management.
+apiVersion: kyverno.io/v2
+kind: PolicyException
+metadata:
+  name: scylla-exemption
+  namespace: kyverno
+spec:
+  exceptions:
+    - policyName: require-drop-all-capabilities
+      ruleNames:
+        - require-drop-all
+        - autogen-require-drop-all
+    - policyName: disallow-automount-sa-token
+      ruleNames:
+        - validate-automount
+        - autogen-validate-automount
+  match:
+    any:
+      - resources:
+          kinds:
+            - Deployment
+            - StatefulSet
+            - ReplicaSet
+            - Pod
+          namespaces:
+            - scylla-manager