fix: set storageClassName=local-path in PVC patch to match live cluster

kubectl apply computes a 3-way merge. The base PVC has no storageClassName
(nil), but the already-bound PVC in the cluster has storageClassName=local-path.
This diff caused apply to attempt a mutation on a bound PVC — forbidden by k8s.

Fix: patch the PVC with storageClassName=local-path so desired state matches
live state and apply produces no diff on the PVC.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

k8s/overlays/on-premise/kustomization.yaml

@@ -19,10 +19,15 @@ resources:
   - ../../base
   - ingress.yaml
 
-# NOTE: mysql-pv.yaml and mysql-pvc-patch.yaml are only needed on clusters
-# without a default StorageClass. This cluster uses 'local-path' (dynamic
-# provisioner), so the base PVC works as-is and must NOT be patched after
-# it is already bound.
+patches:
+  # This patch explicitly sets storageClassName: local-path to match the live
+  # PVC in the cluster. Without it, the base PVC (no storageClassName = nil)
+  # diffs against the existing "local-path" value and kubectl apply tries to
+  # mutate a bound PVC, which Kubernetes forbids.
+  - path: mysql-pvc-patch.yaml
+    target:
+      kind: PersistentVolumeClaim
+      name: mysql-data-pvc
 
 images:
   - name: scrum-frontend