fix: sunbeam apply and bootstrap reliability

manifests.py: fix REPO_ROOT parents index (was 3, needed 2) which
caused kustomize overlay lookup to resolve against the wrong directory.

tools.py: call ensure_tool("helm") before running kustomize so the
bundled helm v3.17.1 is on PATH; system helm v4 dropped the -c flag
that kustomize 5.6.0 uses for version detection.

gitea.py: pass --must-change-password=false to gitea admin user
change-password, removing the separate Postgres UPDATE workaround that
was fragile and required a second exec into the CNPG pod.

sunbeam/manifests.py

@@ -4,7 +4,7 @@ from pathlib import Path
 from sunbeam.kube import kube, kube_out, kube_ok, kube_apply, kustomize_build, get_lima_ip
 from sunbeam.output import step, ok, warn
 
-REPO_ROOT = Path(__file__).parents[3] / "infrastructure"
+REPO_ROOT = Path(__file__).parents[2] / "infrastructure"
 MANAGED_NS = ["data", "devtools", "ingress", "lasuite", "media", "ory", "storage",
               "vault-secrets-operator"]