docs: document CI/CD bootstrap, seed images, and troubleshooting

Add bootstrap checklist (seed-ci-images, Sealed Secrets, two-repo GitOps),
Kaniko BASE_IMAGE/insecure-pull details, platform secret requirements, and
updated gitops install order. Link RUNBOOK-CICD from README.

Co-authored-by: Cursor <cursoragent@cursor.com>

gitops/README.md

@@ -46,34 +46,38 @@ helm upgrade --install argocd argo/argo-cd -n argocd --create-namespace \
 helm upgrade --install gitea gitea-charts/gitea -n gitea --create-namespace \
   -f gitops/gitea/values.yaml --timeout 15m --wait
 
-# 4. TLS + registry secrets در namespaceهای argocd/gitea/cloudhost-builds
+# 4. TLS + registry + egress secrets در namespaceهای argocd/gitea/cloudhost-builds
 for ns in argocd gitea cloudhost-builds; do
   kubectl -n cloudhost get secret abrban-wildcard-tls -o yaml | sed "s/namespace: cloudhost/namespace: ${ns}/" | kubectl apply -f -
   kubectl -n cloudhost get secret registry-pull-secret -o yaml | sed "s/namespace: cloudhost/namespace: ${ns}/" | kubectl apply -f -
 done
-
-# پروکسی egress برای act-runner (دانلود kubectl) و Kaniko (pull ایمیج پایه از docker.io)
 for ns in gitea cloudhost-builds; do
   kubectl -n cloudhost get secret registry-egress-proxy -o yaml | sed "s/namespace: cloudhost/namespace: ${ns}/" | kubectl apply -f -
 done
 
-# 5. git push سورس به Gitea (نه docker push)
+# 5. Seed ایمیج‌های CI در Harbor abrban/ (یک‌بار — الزامی قبل از Pipeline)
+kubectl apply -f gitops/jobs/seed-ci-images.yaml
+kubectl -n cloudhost wait --for=condition=complete job/seed-ci-images --timeout=15m
+
+# 6. Sealed Secrets controller
+helm repo add sealed-secrets https://bitnami.github.io/sealed-secrets
+helm upgrade --install sealed-secrets sealed-secrets/sealed-secrets \
+  -n kube-system -f gitops/sealed-secrets/values.yaml --timeout 10m --wait
+
+# 7. git push سورس به Gitea
 #    git remote add gitea https://git.abrban.com/abrban/cloud-host.git
 #    git push gitea main
-
-# 6. اولین build در کلاستر (Kaniko → abrban/)
-./scripts/trigger-platform-build.sh
-
-# 7. Deploy
-./scripts/gitops-deploy.sh
+#    ریپوی GitOps: https://git.abrban.com/abrban/cloud-host-gitops (SealedSecretها + values)
 
 # 8. Gitea Actions runner
-#    توکن ثبت: SealedSecret در ریپوی cloud-host-gitops (sealed-secrets/gitea-act-runner-token.yaml)
-#    یا دستی: kubectl -n gitea create secret generic gitea-act-runner-token --from-literal=token='<TOKEN>'
+#    توکن ثبت: SealedSecret در cloud-host-gitops/sealed-secrets/gitea-act-runner-token.yaml
 kubectl apply -f gitops/gitea/act-runner.yaml
 
-# 9. Argo CD Application
+# 9. Argo CD Application (multi-source: chart از cloud-host، values از cloud-host-gitops)
 kubectl apply -f gitops/argocd/application-platform.yaml
+
+# 10. اولین deploy: push به main → Gitea Actions → Argo CD sync (جریان عادی)
+#     برای bootstrap دستی: TAG=... ./scripts/gitops-deploy.sh
 ```
 
 ## CI/CD