chore: manual sync for leaf apps, keep root app-of-apps automated

Convention: only the root app-of-apps (bootstrap) auto-syncs so it picks up
new/changed child Application definitions from Git. Every leaf service app
(metallb, metallb-config, envoy-gateway, envoy-gateway-config, nfs-provisioner)
now requires an explicit manual Sync — matches the existing argocd (self-manage)
and ignis convention.

bootstrap/apps/envoy-gateway.yaml

@@ -20,10 +20,8 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: envoy-gateway-system
+  # Leaf app — manual sync only; root `bootstrap` app-of-apps stays automated.
   syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
     syncOptions:
       - CreateNamespace=true
       - ServerSideApply=true