Convention: only the root app-of-apps (bootstrap) auto-syncs so it picks up
new/changed child Application definitions from Git. Every leaf service app
(metallb, metallb-config, envoy-gateway, envoy-gateway-config, nfs-provisioner)
now requires an explicit manual Sync — matches the existing argocd (self-manage)
and ignis convention.
Prevents perpetual OutOfSync on bgppeers.metallb.io and other metallb CRDs caused by apiserver-populated .status fields not present in the Helm chart source.