fix(ci): evaluate short SHA in bash step and include flux-system in root kustomization (#47)

### Summary of Changes

- Evaluated `short_sha` inside a bash step (`id: vars`) so Docker
`build-args` receives the expanded short SHA (e.g. `sha-4429a65`) rather
than literal bash code strings.
- Added `- flux-system` to
`ci/k8s/clusters/production/kustomization.yaml` to prevent Flux from
pruning its own `GitRepository` resource during reconciliation.

ci/k8s/clusters/production/kustomization.yaml

@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
+  - flux-system
   - ../../base/namespaces
   - ../../infrastructure/cert-manager
   - ../../infrastructure/networking