Convention: only the root app-of-apps (platform) auto-syncs so it picks up new/changed child Application definitions from Git. Every leaf service app (vault, headlamp, harbor, jenkins, sonarqube, external-secrets, kube-prometheus-stack) now requires an explicit manual Sync — matches cluster-bootstrap and homelab-services' existing ignis convention.