fix(ci): skip CRD types in kubeconform validation

Skip ArgoCD, cert-manager, and sealed-secrets CRDs that don't have
built-in schemas in kubeconform.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

Author: justgithubaccount

.github/workflows/validate.yaml

@@ -29,7 +29,10 @@ jobs:
           kubectl kustomize clusters/${{ matrix.env }}/ > rendered.yaml
 
       - name: Kubeconform validation
-        run: kubeconform -summary -strict rendered.yaml
+        run: |
+          kubeconform -summary -strict \
+            -skip Application,ApplicationSet,Certificate,ClusterIssuer,SealedSecret \
+            rendered.yaml
 
       - name: OPA policy check
         run: |