Add test-gitops=true label to vault Application to demonstrate end-to-end GitOps sync: commit push → ArgoCD detects change → applies label to live app. Tests that root-app watches k8s/argocd/apps/ and propagates changes.
Wave 0: minio, strimzi-operator, kmsvc-redis, prometheus Wave 1: vault, loki, cloudnative-pg, authentik (manual-sync), temporal, kafka-cluster Wave 2: queue-crd, management-service, grafana, promtail, forgejo Wave 3: forgejo-runner, portainer All auto-sync except authentik (manual-sync only for IAM safety)