chore(forgejo-runner): arm for cascading delete ahead of 3-runner migration

k8s/argocd/apps/30-security.yaml

@@ -131,7 +131,12 @@ spec:
       # than failing on "already exists".
       - ServerSideApply=true
 ---
-# Forgejo runner (local chart).
+# Forgejo runner (local chart), single generic "docker"-labeled instance.
+# Being retired in favor of three language-specific instances of the same
+# chart (forgejo-runner-golang/-node/-rust). Added here ahead of that removal,
+# in its own commit, so it syncs BEFORE the Application is deleted -- a
+# non-cascading delete would otherwise orphan this Deployment, its dind
+# sidecar and both PVCs (same lesson as the Kong retirement).
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -139,6 +144,8 @@ metadata:
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "3"
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
 spec:
   project: homelab
   source: