argocd: ignore the cpu request this cluster rewrites

A Kyverno ClusterPolicy, force-best-effort-cpu, rewrites every container's CPU
request to "0" at admission. It is deliberate and predates this app by well
over a year: the nodes are oversubscribed and BestEffort-on-CPU is how
everything gets scheduled.

The chart asks for 50m and the cluster writes 0, so all three Deployments sat
permanently OutOfSync while perfectly Healthy — the failure mode where a
dashboard is always yellow, everyone learns to ignore it, and it stops meaning
anything the day it goes yellow for a real reason.

Ignored on the Application rather than capitulating in the chart. What the
chart asks for is the honest intent; what the cluster does with it is the
cluster's business, and a reader of the repo should see the former.

jqPathExpressions rather than jsonPointers, which would have to name a
container index and this has to hold for every container in all three
Deployments. Takes effect only after a hard refresh.

deploy/argocd/app.yaml

@@ -67,3 +67,23 @@ spec:
       kind: Job
       jsonPointers:
         - /spec/template/metadata/labels
+    # This cluster runs a Kyverno ClusterPolicy, `force-best-effort-cpu`, whose rule
+    # set-cpu-request-to-zero rewrites every container's CPU request to "0" at admission.
+    # It is deliberate and predates this app by well over a year: the nodes are
+    # oversubscribed, and making pods BestEffort on CPU is how everything gets scheduled.
+    #
+    # The chart asks for 50m and the cluster writes 0, so without this the Deployments sit
+    # permanently OutOfSync while being perfectly Healthy — the failure mode where a
+    # dashboard is always yellow, everyone learns to ignore it, and it stops meaning
+    # anything the day it goes yellow for a real reason.
+    #
+    # The chart deliberately keeps its real request rather than capitulating to 0. What the
+    # chart asks for is the honest intent; what the cluster does with it is the cluster's
+    # business, and a reader of the repo should see the former.
+    #
+    # jqPathExpressions, not jsonPointers: a pointer would have to name a container index,
+    # and this has to hold for every container in every one of the three Deployments.
+    - group: apps
+      kind: Deployment
+      jqPathExpressions:
+        - .spec.template.spec.containers[].resources.requests.cpu