feat(bootstrap): Phase-0 GitHub-seed bootstrap — root-app-github (SSH seed), deploy-key Secret template, cutover URL, bootstrap.sh runner (cilium→longhorn→cnpg→forgejo-db→argocd→cutover)

k8s/bootstrap/phase4-argocd/seed-repo-secret.example.yaml

@@ -0,0 +1,28 @@
+# ArgoCD repo credential for the PRIVATE GitHub seed — deploy key (read-only).
+# Apply at Phase 0 BEFORE root-app-github.yaml. This is a TEMPLATE: never commit
+# the real private key.
+#
+#   ssh-keygen -t ed25519 -C "argocd@homelab" -f argocd_seed -N ""
+#   # add argocd_seed.pub → GitHub repo → Settings → Deploy keys (Read-only, no write)
+#   kubectl create ns argocd --dry-run=client -o yaml | kubectl apply -f -
+#   kubectl -n argocd create secret generic seed-github-repo \
+#     --from-literal=type=git \
+#     [email protected]:Riotpiaole/riotpiao.homelab.com.git \
+#     --from-file=sshPrivateKey=argocd_seed
+#   kubectl -n argocd label secret seed-github-repo argocd.argoproj.io/secret-type=repository
+#
+# url MUST match root-app-github.yaml's repoURL (SSH form).
+apiVersion: v1
+kind: Secret
+metadata:
+  name: seed-github-repo
+  namespace: argocd
+  labels:
+    argocd.argoproj.io/secret-type: repository
+stringData:
+  type: git
+  url: [email protected]:Riotpiaole/riotpiao.homelab.com.git
+  sshPrivateKey: |
+    -----BEGIN OPENSSH PRIVATE KEY-----
+    REPLACE-WITH-READ-ONLY-DEPLOY-KEY-PRIVATE-HALF — DO NOT COMMIT THE REAL KEY
+    -----END OPENSSH PRIVATE KEY-----