feat(argocd): register poimen-workflows Application, tighten sourceRepos

Adds the Application for the poimen-workflows Temporal worker under the
poimen AppProject, and narrows sourceRepos from the rock/* wildcard to
an explicit allowlist (only repos with a registered Application belong
here).

k8s/argocd/poimen-workflows.yaml

@@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: poimen-workflows
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: poimen-workflows
+    app.kubernetes.io/component: orchestrator
+spec:
+  project: poimen
+  source:
+    repoURL: https://forgejo.riotpiao.com/rock/poimen-workflows.git
+    targetRevision: main
+    path: k8s
+    plugin:
+      name: kustomize
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: poimen
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    retry:
+      limit: 5
+      backoff:
+        duration: 5s
+        factor: 2
+        maxDuration: 3m

k8s/argocd/root.yaml

@@ -4,8 +4,11 @@ metadata:
   name: poimen
   namespace: argocd
 spec:
+  # Explicit allowlist, not the 'rock/*' wildcard -- only repos with an actual
+  # Application under this project belong here. Add a line here when (and only
+  # when) a new Application is registered.
   sourceRepos:
-  - 'https://forgejo.riotpiao.com/rock/*'
+  - 'https://forgejo.riotpiao.com/rock/poimen-workflows.git'
   destinations:
   - namespace: 'poimen'
     server: https://kubernetes.default.svc