fix: ServerSideApply on argocd Application to prune stale fields

argocd was originally helm-installed by hand before ArgoCD existed to
manage it; client-side 3-way merge apply can't prune fields it never
saw in a last-applied-configuration, so a later chart bump left a stale
args on repo-server's copyutil init container (old shell-string command
lingering alongside the new plain cp command) -> cp got 4 args instead
of 3 -> 'No such file or directory' -> CrashLoopBackOff -> Degraded.

Same bug class as envoy-gateway (020b248). ServerSideApply=true tracks
field ownership properly and prunes the stray field on next sync.

bootstrap/apps/argocd.yaml

@@ -20,3 +20,12 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: argocd
+  # ArgoCD was originally `helm install`ed by hand before ArgoCD existed to
+  # manage it (see README Phase 3), so client-side 3-way merge apply can't
+  # see/prune fields from that pre-existing object — left a stale `args` on
+  # argocd-repo-server's copyutil init container after a later chart bump,
+  # crashlooping it (same bug class as envoy-gateway, see 020b248).
+  # ServerSideApply properly tracks field ownership and prunes it.
+  syncPolicy:
+    syncOptions:
+      - ServerSideApply=true

bootstrap/apps/envoy-gateway-config.yaml

@@ -14,9 +14,7 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: envoy-gateway-system
+  # Leaf app — manual sync only; root `bootstrap` app-of-apps stays automated.
   syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
     syncOptions:
       - SkipDryRunOnMissingResource=true

bootstrap/apps/envoy-gateway.yaml

@@ -20,10 +20,8 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: envoy-gateway-system
+  # Leaf app — manual sync only; root `bootstrap` app-of-apps stays automated.
   syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
     syncOptions:
       - CreateNamespace=true
       - ServerSideApply=true

bootstrap/apps/metallb-config.yaml

@@ -14,10 +14,8 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: metallb-system
+  # Leaf app — manual sync only; root `bootstrap` app-of-apps stays automated.
   syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
     syncOptions:
       - CreateNamespace=true
       - SkipDryRunOnMissingResource=true

bootstrap/apps/metallb.yaml

@@ -20,10 +20,8 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: metallb-system
+  # Leaf app — manual sync only; root `bootstrap` app-of-apps stays automated.
   syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
     syncOptions:
       - CreateNamespace=true
   ignoreDifferences:

bootstrap/apps/nfs-provisioner.yaml

@@ -20,9 +20,7 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: nfs-provisioner
+  # Leaf app — manual sync only; root `bootstrap` app-of-apps stays automated.
   syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
     syncOptions:
       - CreateNamespace=true

manifests/argocd/backend-traffic-policy.yaml

@@ -0,0 +1,13 @@
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+  name: argocd
+  namespace: argocd
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: argocd
+  timeout:
+    http:
+      requestTimeout: 120s