fix(keycloak): reword comments to avoid kcc substitutor false matches

kcc resolves $(env:VAR) placeholders via Apache Commons StringSubstitutor
over the whole file BEFORE parsing as YAML, so even comments are
scanned for unresolved variables. The previous comment block in
keycloak_defaults.yaml literally described the placeholder pattern as
"$(env:VAR)", which kcc treated as a real reference and failed with
"Cannot resolve variable 'env:VAR' (enableSubstitutionInVariables=true)"
before applying anything.

Rewords the comment to describe the syntax without writing the literal
shape, and adds an explicit warning so future editors don't reintroduce
the trap.

Caught during E2E on the refactored branch: the new
keycloak-config-import Secret carried the original comment verbatim,
so the kcc Job failed-fast on every retry until the comment was
sanitized. Post-fix E2E (kind-nebari-local, fresh deploy) ran the kcc
Job to completion in seconds and produced the expected realm state
(all 7 default scopes on both realm and argocd client, both
argocd-admins/argocd-viewers groups, admin user member of
argocd-admins).

Author: viniciusdc

pkg/argocd/keycloak_defaults.yaml

@@ -9,12 +9,16 @@
 # Keycloak.
 #
 # The gitops repo never sees this content. Realm structure and any
-# inline credentials (none currently — we use $(env:VAR) placeholders)
-# stay inside the cluster's Secret store.
+# inline credentials (none currently; secret-bearing fields use kcc's
+# variable-substitution syntax) stay inside the cluster's Secret store.
 #
-# `$(env:VAR)` placeholders are substituted by kcc at apply time from env
-# vars set on the Job (see templates/manifests/keycloak/realm-setup-job.yaml).
-# `{{ .Domain }}` is rendered by Go's text/template at NIC deploy time.
+# kcc resolves placeholders via Apache Commons StringSubstitutor BEFORE
+# parsing the file as YAML. That means even comments are scanned for
+# unresolved variables, so do NOT write the literal placeholder shape
+# inside any comment in this file or kcc will fail with
+# "Cannot resolve variable" before applying anything. The actual
+# placeholders live in field values below.
+# {{ .Domain }} is rendered by Go's text/template at NIC deploy time.
 realm: nebari
 enabled: true
 displayName: Nebari