feat(argocd): register poimen-workflows Application, tighten sourceRepos

Adds the Application for the poimen-workflows Temporal worker under the
poimen AppProject, and narrows sourceRepos from the rock/* wildcard to
an explicit allowlist (only repos with a registered Application belong
here).

k8s/argocd/root.yaml

@@ -4,8 +4,11 @@ metadata:
   name: poimen
   namespace: argocd
 spec:
+  # Explicit allowlist, not the 'rock/*' wildcard -- only repos with an actual
+  # Application under this project belong here. Add a line here when (and only
+  # when) a new Application is registered.
   sourceRepos:
-  - 'https://forgejo.riotpiao.com/rock/*'
+  - 'https://forgejo.riotpiao.com/rock/poimen-workflows.git'
   destinations:
   - namespace: 'poimen'
     server: https://kubernetes.default.svc