fix(kyverno): enable background processing and fix precondition check

- Change background: false -> true to allow retries when base secret
  not available at admission time
- Fix precondition to check specific key (AWS_ACCESS_KEY_ID) with
  fallback instead of comparing map to empty string

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: mitchross

infrastructure/controllers/kyverno/volsync-smart-restore.yaml

@@ -23,7 +23,7 @@ metadata:
       - Backups protect data going forward (Restic keeps retention/history)
 spec:
   validationFailureAction: Enforce
-  background: false
+  background: true
   rules:
     # ------------------------------------------------------------------
     # RULE 1: GENERATE PER-PVC SECRET (copies base creds + full repo path)
@@ -43,7 +43,8 @@ spec:
             jmesPath: "data"
       preconditions:
         all:
-          - key: "{{ baseSecret }}"
+          # Check that base secret has the required keys
+          - key: "{{ baseSecret.AWS_ACCESS_KEY_ID || '' }}"
             operator: NotEquals
             value: ""
       generate: