fix(ci): evaluate short SHA in bash step and include flux-system in root kustomization (#47)

### Summary of Changes

- Evaluated `short_sha` inside a bash step (`id: vars`) so Docker
`build-args` receives the expanded short SHA (e.g. `sha-4429a65`) rather
than literal bash code strings.
- Added `- flux-system` to
`ci/k8s/clusters/production/kustomization.yaml` to prevent Flux from
pruning its own `GitRepository` resource during reconciliation.

.github/workflows/services-www-releases-dispatch-release.yml

@@ -265,9 +265,11 @@ jobs:
           # Extract MAJOR.MINOR for tagging
           MAJOR_MINOR=$(echo "${{ github.ref_name }}" | cut -d/ -f3 | sed 's/^v//')
           MAJOR=$(echo "$MAJOR_MINOR" | cut -d. -f1)
+          SHORT_SHA="sha-$(echo ${{ github.sha }} | cut -c1-7)"
           echo "version=$RELEASE_VERSION" >> $GITHUB_OUTPUT
           echo "major_minor=$MAJOR_MINOR" >> $GITHUB_OUTPUT
           echo "major=$MAJOR" >> $GITHUB_OUTPUT
+          echo "short_sha=$SHORT_SHA" >> $GITHUB_OUTPUT
 
       - name: Create and Push Tag
         run: |
@@ -303,7 +305,7 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
-            COMMIT_SHA=sha-$(echo ${{ github.sha }} | cut -c1-7)
+            COMMIT_SHA=${{ steps.version.outputs.short_sha }}
             VERSION=v${{ steps.version.outputs.version }}
 
   deploy: