fix: ignore Reloader's injected env var on the Forgejo Deployment

Argo would otherwise strip STAKATER_* on each sync and fight Reloader for it,
recreating the forge pod every reconcile.

k8s/argocd/apps/30-security.yaml

@@ -115,6 +115,16 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: cicd
+  # Reloader injects a STAKATER_* env var carrying a hash of the config Secret,
+  # so the pod rolls when that Secret changes. The chart does not render it, so
+  # Argo would strip it on every sync — and with selfHeal on, Argo and Reloader
+  # would fight over the field and Recreate the forge each round.
+  ignoreDifferences:
+    - group: apps
+      kind: Deployment
+      name: forgejo-gitea
+      jqPathExpressions:
+        - '.spec.template.spec.containers[].env[] | select(.name | startswith("STAKATER_"))'
   syncPolicy:
     syncOptions:
       # Adopt the objects the bootstrap Helm release already created rather