ci: split GitOps state into cloud-host-gitops repo, add Sealed Secrets, fix pipeline auth

- Workflow now pushes image tags to the separate cloud-host-gitops repo
  (no more CI loop risk) and authenticates via CI_TOKEN secret
- Fix undefined ${REGISTRY} in Kaniko jobs, add concurrency group,
  targeted tag update, and mounted kaniko-harbor-auth docker config
- Argo CD Application is now multi-source (chart from cloud-host,
  values from cloud-host-gitops)
- Remove plaintext runner token and proxy credentials from manifests;
  secrets are now SealedSecrets in the gitops repo

Co-authored-by: Cursor <cursoragent@cursor.com>

gitops/README.md

@@ -52,6 +52,9 @@ for ns in argocd gitea cloudhost-builds; do
   kubectl -n cloudhost get secret registry-pull-secret -o yaml | sed "s/namespace: cloudhost/namespace: ${ns}/" | kubectl apply -f -
 done
 
+# پروکسی egress برای act-runner (دانلود kubectl در initContainer)
+kubectl -n cloudhost get secret registry-egress-proxy -o yaml | sed 's/namespace: cloudhost/namespace: gitea/' | kubectl apply -f -
+
 # 5. git push سورس به Gitea (نه docker push)
 #    git remote add gitea https://git.abrban.com/abrban/cloud-host.git
 #    git push gitea main
@@ -63,6 +66,8 @@ done
 ./scripts/gitops-deploy.sh
 
 # 8. Gitea Actions runner
+#    توکن ثبت: SealedSecret در ریپوی cloud-host-gitops (sealed-secrets/gitea-act-runner-token.yaml)
+#    یا دستی: kubectl -n gitea create secret generic gitea-act-runner-token --from-literal=token='<TOKEN>'
 kubectl apply -f gitops/gitea/act-runner.yaml
 
 # 9. Argo CD Application
@@ -73,4 +78,8 @@ kubectl apply -f gitops/argocd/application-platform.yaml
 
 Gitea Actions: [.gitea/workflows/build-deploy.yaml](../.gitea/workflows/build-deploy.yaml)
 
-Push به `main` → Kaniko (از Harbor proxy) → push به `abrban/` → ArgoCD sync.
+Push به `main` → Kaniko → push به `abrban/` → کامیت tag در ریپوی [cloud-host-gitops](https://git.abrban.com/abrban/cloud-host-gitops) → ArgoCD sync.
+
+- مقادیر Production در ریپوی جدا `abrban/cloud-host-gitops` است (`platform/values-abrban.yaml`)؛ Application به‌صورت multi-source تعریف شده.
+- Secretهای CI به‌صورت SealedSecret در همان ریپو هستند (کنترلر در `kube-system`، values در `gitops/sealed-secrets/values.yaml`).
+- مستند کامل: [RUNBOOK-CICD.fa.md](../RUNBOOK-CICD.fa.md)