feat(addons): Enable Platform layer addons for cloudfront-exposure

Parent: #699

## Addons

- [ ] `gitlab` — see #698 for full design
- [ ] `crossplane_aws` — AWS Crossplane provider (spoke provisioning, aws-resources)
- [ ] `kro_manifests_hub` — ResourceGraphDefinitions (EksCluster, Vpc, CICDPipeline)
- [ ] `platform_manifests_hub` — hub platform manifests (RBAC, namespaces)
- [ ] `multi_acct` — cross-account IAM roles for spoke management
- [ ] `kubevela` — OAM app delivery engine (S3 template uses it)
- [ ] `devlake` — DORA metrics (needs ingress with path rewrite for cloudfront)
- [ ] `image_prepuller` — DaemonSet to pre-pull large ML images
- [ ] `cert_manager` — cert-manager for internal TLS and webhook certs

## CloudFront Ingress Changes Needed

- `gitlab`: needs `/gitlab` path + transforms annotation
- `devlake`: needs `/devlake` path + transforms annotation

## Notes

- `crossplane_aws` requires Pod Identity association (already handled by `pod-identities` addon)
- `kro_manifests_hub` depends on KRO Capability being ACTIVE (already done)
- `cert_manager` has no ingress — just enable it

Start with parent issue #699 and the full design in #698, then review how the listed addons are enabled and how CloudFront ingress paths are configured. Done means enabling the requested addons, adding the GitLab and DevLake path and transform changes, and respecting the stated Pod Identity and KRO dependencies.

Written by the indexing model from the issue text.