ci: split GitOps state into cloud-host-gitops repo, add Sealed Secrets, fix pipeline auth

- Workflow now pushes image tags to the separate cloud-host-gitops repo
  (no more CI loop risk) and authenticates via CI_TOKEN secret
- Fix undefined ${REGISTRY} in Kaniko jobs, add concurrency group,
  targeted tag update, and mounted kaniko-harbor-auth docker config
- Argo CD Application is now multi-source (chart from cloud-host,
  values from cloud-host-gitops)
- Remove plaintext runner token and proxy credentials from manifests;
  secrets are now SealedSecrets in the gitops repo

Co-authored-by: Cursor <cursoragent@cursor.com>

gitops/sealed-secrets/values.yaml

@@ -0,0 +1,15 @@
+# Sealed Secrets controller — encrypts secrets so they can live in Git.
+# Install:
+#   helm repo add sealed-secrets https://bitnami.github.io/sealed-secrets
+#   helm upgrade --install sealed-secrets sealed-secrets/sealed-secrets \
+#     -n kube-system -f gitops/sealed-secrets/values.yaml
+#
+# fullnameOverride matches the default the kubeseal CLI expects
+# (sealed-secrets-controller in kube-system), so kubeseal works without flags.
+fullnameOverride: sealed-secrets-controller
+
+image:
+  # Seeded into Harbor abrban/ project from ghcr.io/bitnami (proxy-ghcr returned 401
+  # for kubelet pulls; see seed job pattern in gitops/jobs/seed-ci-images.yaml).
+  registry: registry.abrban.com
+  repository: abrban/sealed-secrets-controller