fix: remove namespace from rbac Application destination

- RBAC kustomization contains cluster-scoped (ClusterRoleBinding) and
  namespace-scoped (Role/RoleBinding) resources
- Each resource has explicit metadata.namespace, so Application shouldn't
  force a default namespace
- Fixes: ClusterRoleBinding gets namespace=default, causing sync failure
  with 'unsupported role reference kind: ""'

k8s/argocd/apps/60-applications.yaml

@@ -286,7 +286,8 @@ spec:
     path: k8s/infra/rbac
   destination:
     server: https://kubernetes.default.svc
-    namespace: default
+    # No namespace: cluster-scoped resources (ClusterRoleBinding, etc.)
+    # Namespace is set per-resource in kustomization
   syncPolicy:
     automated:
       prune: true