Point the control-plane ref at the stable mirror CR

CONTROL_PLANE_REF_NAME held the random suffix the Gateway operator gives
its auto-created mirror CR, looked up by hand. Replacing the Konnect org
recreated those CRs under new suffixes, so the ref named an object that
no longer existed and the domain's Kong entities sat Programmed=False.

Name the ${NAME}-cp mirror declared in k8s-platform's dataplane-template
instead — derived from NAME, so it stays valid across Gateway
recreations and Konnect org changes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

dev/flux-kustomization.yaml

@@ -17,7 +17,7 @@ spec:
     substitute:
       NAME: workforce-dev
       NAMESPACE: workforce
-      CONTROL_PLANE_REF_NAME: workforce-dev-6cq27
+      CONTROL_PLANE_REF_NAME: workforce-dev-cp
       BACKEND_HOST: classic-models-api.classic-models.svc.cluster.local
       OIDC_ISSUER: https://keycloak.sttlab.local/realms/classic-models
       API_AUDIENCE: '["workforce-api"]'