fix(argocd): clone the public GitHub seed anonymously over HTTPS and delete the SSH deploy-key Secret — its private half had been committed in plaintext to a public remote, and a public repo needs no credential at all

k8s/bootstrap/phase4-argocd/root-app-github.yaml

@@ -3,8 +3,8 @@
 # GitHub seed so ArgoCD can deploy everything after the control plane. After
 # Forgejo is healthy + mirroring GitHub, cut over with phase5-cutover/root-app-forgejo.yaml.
 #
-# repoURL is the SSH form — must match the `url` in the seed-repo deploy-key Secret
-# (see seed-repo-secret.example.yaml). Apply that Secret before this.
+# repoURL is anonymous HTTPS — the seed repo is public, so no deploy key and no
+# repository Secret are needed. Nothing to apply before this.
 ---
 apiVersion: v1
 kind: Namespace
@@ -44,7 +44,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git   # GitHub seed (SSH)
+    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git   # GitHub seed (SSH)
     targetRevision: main
     path: k8s/argocd/apps
   destination:

k8s/bootstrap/phase4-argocd/seed-repo-secret.example.yaml

@@ -1,28 +0,0 @@
-# ArgoCD repo credential for the PRIVATE GitHub seed — deploy key (read-only).
-# Apply at Phase 0 BEFORE root-app-github.yaml. This is a TEMPLATE: never commit
-# the real private key.
-#
-#   ssh-keygen -t ed25519 -C "argocd@homelab" -f argocd_seed -N ""
-#   # add argocd_seed.pub → GitHub repo → Settings → Deploy keys (Read-only, no write)
-#   kubectl create ns argocd --dry-run=client -o yaml | kubectl apply -f -
-#   kubectl -n argocd create secret generic seed-github-repo \
-#     --from-literal=type=git \
-#     [email protected]:Riotpiaole/riotpiao.homelab.com.git \
-#     --from-file=sshPrivateKey=argocd_seed
-#   kubectl -n argocd label secret seed-github-repo argocd.argoproj.io/secret-type=repository
-#
-# url MUST match root-app-github.yaml's repoURL (SSH form).
-apiVersion: v1
-kind: Secret
-metadata:
-  name: seed-github-repo
-  namespace: argocd
-  labels:
-    argocd.argoproj.io/secret-type: repository
-stringData:
-  type: git
-  url: [email protected]:Riotpiaole/riotpiao.homelab.com.git
-  sshPrivateKey: |
-    -----BEGIN OPENSSH PRIVATE KEY-----
-    REPLACE-WITH-READ-ONLY-DEPLOY-KEY-PRIVATE-HALF — DO NOT COMMIT THE REAL KEY
-    -----END OPENSSH PRIVATE KEY-----