Deploy workforce/dev dataplane (Layer 2), mirroring the other domains

Real Konnect Control Plane 1dbd741c-0da2-4718-8c72-6f479530b371, PAT
in Vault. Replaces the TODO stubs with the proven three-file
pattern. JWT_AUDIENCE_WHITELIST includes mcp-workforce from the
start since Layer 3 was built the same session — see STATUS.md
section 23.

dev/api-gateway/policies-kustomization.yaml

@@ -0,0 +1,22 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: workforce-dev-api-gateway-policies
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: k8s-platform
+  path: ./dataplane-globalpolicy-template
+  prune: true
+  postBuild:
+    substitute:
+      NAME: workforce-dev
+      NAMESPACE: workforce
+      CONTROL_PLANE_REF_NAME: workforce-dev-6cq27
+      JWT_AUDIENCE_WHITELIST: '["workforce-api", "mcp-workforce"]'
+      OIDC_ISSUER: https://keycloak.sttlab.local/realms/classic-models
+    substituteFrom:
+      - kind: ConfigMap
+        name: dataplane-template-defaults