ci: split GitOps state into cloud-host-gitops repo, add Sealed Secrets, fix pipeline auth

- Workflow now pushes image tags to the separate cloud-host-gitops repo
  (no more CI loop risk) and authenticates via CI_TOKEN secret
- Fix undefined ${REGISTRY} in Kaniko jobs, add concurrency group,
  targeted tag update, and mounted kaniko-harbor-auth docker config
- Argo CD Application is now multi-source (chart from cloud-host,
  values from cloud-host-gitops)
- Remove plaintext runner token and proxy credentials from manifests;
  secrets are now SealedSecrets in the gitops repo

Co-authored-by: Cursor <cursoragent@cursor.com>

gitops/gitea/act-runner.yaml

@@ -1,13 +1,17 @@
 # Gitea Actions runner — host mode (no docker.sock; k3s uses containerd)
 # Runner creates Kaniko Jobs in cloudhost-builds for image builds.
-apiVersion: v1
-kind: Secret
-metadata:
-  name: gitea-act-runner-token
-  namespace: gitea
-type: Opaque
-stringData:
-  token: "nL63VkZEyqpCNFdF3AMM9wzQLdLlATUvXSe5Tj0R"
+#
+# Secrets (never commit real values):
+#
+#   # Registration token: managed as SealedSecret in the cloud-host-gitops repo
+#   # (sealed-secrets/gitea-act-runner-token.yaml). To rotate manually:
+#   #   token from Gitea UI → Site Administration → Actions → Runners, then:
+#   kubectl -n gitea create secret generic gitea-act-runner-token \
+#     --from-literal=token='<RUNNER_REGISTRATION_TOKEN>'
+#
+#   # Egress proxy (copied from cloudhost namespace, needed by the kubectl download):
+#   kubectl -n cloudhost get secret registry-egress-proxy -o yaml \
+#     | sed 's/namespace: cloudhost/namespace: gitea/' | kubectl apply -f -
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -64,7 +68,10 @@ spec:
           imagePullPolicy: IfNotPresent
           env:
             - name: HTTPS_PROXY
-              value: "http://builder:BeeldiOr!12009@45.129.38.203:9911"
+              valueFrom:
+                secretKeyRef:
+                  name: registry-egress-proxy
+                  key: HTTPS_PROXY
           command:
             - sh
             - -c