- ClusterIssuers + Certificates now back in TF - Will import existing live resources
- Will import separately after helm issues resolved - Avoids re-create conflicts during bootstrap apply
- ArgoCD migrated to argocd namespace - Cert-manager issuers/certs created - 20 namespaces imported with pod-security labels - S3 backend temporarily offline (MinIO), using local backup - Pending: Remove metadata drift from helm releases, re-apply