ci: split GitOps state into cloud-host-gitops repo, add Sealed Secrets, fix pipeline auth

- Workflow now pushes image tags to the separate cloud-host-gitops repo
  (no more CI loop risk) and authenticates via CI_TOKEN secret
- Fix undefined ${REGISTRY} in Kaniko jobs, add concurrency group,
  targeted tag update, and mounted kaniko-harbor-auth docker config
- Argo CD Application is now multi-source (chart from cloud-host,
  values from cloud-host-gitops)
- Remove plaintext runner token and proxy credentials from manifests;
  secrets are now SealedSecrets in the gitops repo

Co-authored-by: Cursor <cursoragent@cursor.com>

gitops/argocd/application-platform.yaml

@@ -1,19 +1,23 @@
+# Source of truth for this file: cloud-host-gitops repo (argocd/application-platform.yaml).
+# Kept here as a mirror for bootstrap convenience.
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   name: abrban-platform
   namespace: argocd
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
 spec:
   project: default
-  source:
-    repoURL: https://git.abrban.com/abrban/cloud-host.git
-    targetRevision: main
-    path: backend/helm/cloudhost-platform
-    helm:
-      valueFiles:
-        - ../../../gitops/platform/values-abrban.yaml
+  # Multi-source: chart lives in the app repo, values (GitOps state) live in cloud-host-gitops.
+  sources:
+    - repoURL: https://git.abrban.com/abrban/cloud-host.git
+      targetRevision: main
+      path: backend/helm/cloudhost-platform
+      helm:
+        valueFiles:
+          - $values/platform/values-abrban.yaml
+    - repoURL: https://git.abrban.com/abrban/cloud-host-gitops.git
+      targetRevision: main
+      ref: values
   destination:
     server: https://kubernetes.default.svc
     namespace: cloudhost