Protect sylva-units HelmRelease from accidental deletion using a ValidatingAdmissionPolicy

Introduce a ValidatingAdmissionPolicy (VAP) to deny deletion of the sylva-units HelmRelease in the sylva-system namespace on management clusters.

This provides a simple safeguard against accidental deletion of a critical resource that can leave the management cluster in a broken state. The approach avoids additional complexity such as prune: false, special labels, or resource-protection mechanisms, while remaining consistent with existing admission-policy-based protections in Sylva.

Inspiration from sylva-projects/sylva-elements/sylva-units-operator!508 (comment 3411945967)

In order to land the "have minimal protection avoid huge breakage" soon, another solution could be to simply deny the deletion of sylva-units HelmRelease in sylva-system namespace as we do for cluster resources (and maybe take that opportunity to implement that policy as a VAP)