ArgoCD only builds a helm-pull command for oci:// sources when the repo is
registered with enableOCI: true; otherwise it falls back to classic --repo
handling, which errors on an oci:// URL. Registered via configs.repositories
in argocd's own values.yaml (Git-managed), Application source updated to
the bare host/path form ArgoCD expects for OCI repos.
Drop .env/envsubst/bake-hash-into-values.yaml flow entirely. Chart's
configs.secret block is removed for good, so the rendered manifest
never declares admin.password/admin.passwordMtime. Password hash is
set once directly on the live argocd-secret via kubectl patch, and
survives every self-heal sync since ArgoCD never owns those fields.
- remove server.httproute from argocd values.yaml: helm install failed
since Gateway API CRDs (installed by envoy-gateway, wave 2) don't
exist yet; HTTPRoute is already applied manually in Phase 6
- add bootstrap-app.yaml as the Git-committed root/seed Application,
replacing ad-hoc UI creation (GitOps anti-pattern: apps not stored
in Git can't be recreated)
