fix(security): hold annotation enforcement until ESO metadata is explicit

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e7fb-275d-7db0-b1df-39ed943427da

argocd/platform-addons/secret-annotation-guard/policy.yaml

@@ -17,11 +17,3 @@ spec:
   validations:
     - expression: '!has(object.metadata.annotations) || !("kubectl.kubernetes.io/last-applied-configuration" in object.metadata.annotations)'
       message: "Secret last-applied annotations are forbidden; use server-side apply or replace."
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicyBinding
-metadata:
-  name: reject-secret-last-applied
-spec:
-  policyName: reject-secret-last-applied
-  validationActions: [Deny]