fix: break init chicken-and-egg with sync-wave ordering

Job was PostSync hook — ArgoCD failed sync phase because ClusterSecretStore
was Ready=False (OpenBao sealed), so PostSync never ran → Job never ran →
OpenBao never initialized → ClusterSecretStore always sealed. Loop.

Fix: Job is now a regular sync resource at wave 1. ClusterSecretStore moves
to wave 2. ArgoCD waits for the Job to complete before deploying the store.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 2 people

apps/openbao-init/templates/clustersecretstore.yaml

@@ -4,6 +4,7 @@ metadata:
   name: {{ .Values.eso.clusterSecretStoreName }}
   annotations:
     argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+    argocd.argoproj.io/sync-wave: "2"
 spec:
   provider:
     vault:

apps/openbao-init/templates/job-init.yaml

@@ -4,8 +4,7 @@ metadata:
   name: openbao-init
   namespace: {{ .Release.Namespace }}
   annotations:
-    argocd.argoproj.io/hook: PostSync
-    argocd.argoproj.io/hook-delete-policy: HookSucceeded
+    argocd.argoproj.io/sync-wave: "1"
 spec:
   backoffLimit: 2
   template: