chore(headlamp): remove remaining resources

[xnoto]

Summary

• remove the Headlamp child Application, namespace, OIDC Secret, and KSOPS generator
• remove Headlamp from the operators Kustomization
• remove the unused encrypted Headlamp Dex client secret with SOPS

Safety

The TunnelBinding and Dex static client were removed and verified in the preceding phase. The live Headlamp Application has resources-finalizer.argocd.argoproj.io, so pruning it should cascade-delete Helm-managed namespaced and cluster-scoped resources instead of orphaning the cluster-admin binding.

The Terraform-managed DNS record is intentionally handled separately after GitOps cleanup.

Validation

• SOPS decrypt/MAC validation without emitting plaintext
• no remaining tracked headlamp references
• kustomize build bootstrap
• kustomize build --enable-alpha-plugins --enable-exec operators
• kustomize build workloads/apps
• pre-commit run --all-files