fix(manifests): exclude sso-credentials from kustomize to prevent clobber

The sso-credentials.yaml contains CHANGE_ME placeholders. Including it
in kustomize resources causes oc apply -k to overwrite manually-set
secret values. Same pattern as the CRB namespace clobber fix.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: jsell-rh

components/manifests/overlays/hcmais/jsell-sso-poc/kustomization.yaml

@@ -5,7 +5,9 @@ namespace: jsell-ambient-sso-poc
 
 resources:
 - ../../../base
-- sso-credentials.yaml
+# sso-credentials.yaml is excluded — it contains CHANGE_ME placeholders.
+# Create the secret manually per workflows/deploy-native-sso.md Step 3a,
+# or apply sso-credentials.yaml separately after replacing values.
 - frontend-route.yaml
 - public-api-route.yaml
 - api-server-route.yaml