docs: document CI/CD bootstrap, seed images, and troubleshooting

Add bootstrap checklist (seed-ci-images, Sealed Secrets, two-repo GitOps),
Kaniko BASE_IMAGE/insecure-pull details, platform secret requirements, and
updated gitops install order. Link RUNBOOK-CICD from README.

Co-authored-by: Cursor <cursoragent@cursor.com>

gitops/jobs/seed-ci-images.yaml

@@ -1,4 +1,13 @@
-# Bootstrap: copy act_runner + kaniko into abrban/ (kubelet cannot use proxy-cache reliably)
+# Bootstrap: seed CI/build images into Harbor project abrban/
+#
+# kubelet and Kaniko cannot reliably use Harbor proxy-cache for all images.
+# Run once after Harbor is up and registry-egress-proxy exists in cloudhost:
+#
+#   kubectl apply -f gitops/jobs/seed-ci-images.yaml
+#   kubectl -n cloudhost wait --for=condition=complete job/seed-ci-images --timeout=15m
+#
+# Images copied (see RUNBOOK-CICD.fa.md):
+#   abrban/act-runner, abrban/alpine-git, abrban/node, abrban/kaniko-executor
 apiVersion: batch/v1
 kind: Job
 metadata:
@@ -25,6 +34,7 @@ spec:
             - |
               set -eux
               DEST="docker://harbor-registry.cloudhost.svc.cluster.local:5000/abrban"
+              # Must match harbor-core → REGISTRY_CREDENTIAL_PASSWORD (default: harbor_registry_password)
               CREDS="harbor_registry_user:harbor_registry_password"
               skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
                 docker://docker.io/gitea/act_runner:0.2.11 \