convert deploy manifests to kustomization format

Adds kustomization.yaml to enforce explicit resource ordering
(namespace before deployment/service). Updates CI to use
kubectl apply -k instead of kubectl apply -f.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/kubernetes-deploy.yaml

@@ -106,4 +106,4 @@ jobs:
           kubectl auth whoami
           kubectl get ns
 
-          kubectl apply -f deploy/
+          kubectl apply -k deploy/

deploy/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace_gateway-cert-operator-system.yaml
+  - serviceaccount_gateway-cert-operator.yaml
+  - clusterrole_gateway-cert-operator.yaml
+  - clusterrolebinding_gateway-cert-operator.yaml
+  - deployment_gateway-cert-operator.yaml
+  - service_gateway-cert-operator-metrics.yaml