ci: split GitOps state into cloud-host-gitops repo, add Sealed Secrets, fix pipeline auth

- Workflow now pushes image tags to the separate cloud-host-gitops repo
  (no more CI loop risk) and authenticates via CI_TOKEN secret
- Fix undefined ${REGISTRY} in Kaniko jobs, add concurrency group,
  targeted tag update, and mounted kaniko-harbor-auth docker config
- Argo CD Application is now multi-source (chart from cloud-host,
  values from cloud-host-gitops)
- Remove plaintext runner token and proxy credentials from manifests;
  secrets are now SealedSecrets in the gitops repo

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/gitops-deploy.sh

@@ -5,9 +5,17 @@ set -euo pipefail
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 NAMESPACE="${NAMESPACE:-cloudhost}"
 RELEASE="${RELEASE:-cloudhost}"
-VALUES="${VALUES:-${ROOT}/gitops/platform/values-abrban.yaml}"
+# Production values now live in the cloud-host-gitops repo (platform/values-abrban.yaml).
+VALUES="${VALUES:-${ROOT}/../cloud-host-gitops/platform/values-abrban.yaml}"
 TAG="${TAG:-}"
 
+if [[ ! -f "${VALUES}" ]]; then
+  echo "ERROR: values file not found: ${VALUES}" >&2
+  echo "Clone the GitOps repo next to this one, or pass VALUES=/path/to/values-abrban.yaml:" >&2
+  echo "  git clone https://git.abrban.com/abrban/cloud-host-gitops.git" >&2
+  exit 1
+fi
+
 if [[ -z "${TAG}" ]]; then
   TAG="$(grep -E '^\s+tag:' "${VALUES}" | head -1 | sed 's/.*tag: *"\?\([^"]*\)"\?.*/\1/')"
 fi

scripts/trigger-platform-build.sh

@@ -70,9 +70,8 @@ EOF
 echo "==> Waiting for build job..."
 kubectl -n "${NAMESPACE}" wait --for=condition=complete "job/${JOB_NAME}" --timeout=45m
 
-echo "==> Updating values-abrban.yaml tag to ${IMAGE_TAG}"
-sed -i.bak "s|tag: \".*\"|tag: \"${IMAGE_TAG}\"|g" "${ROOT}/gitops/platform/values-abrban.yaml"
-rm -f "${ROOT}/gitops/platform/values-abrban.yaml.bak"
-
-echo "==> Build complete. Deploy with:"
+echo "==> Build complete (tag=${IMAGE_TAG})."
+echo "To deploy via GitOps, commit the tag in the cloud-host-gitops repo:"
+echo "   platform/values-abrban.yaml → images.backend.tag / images.frontend.tag = \"${IMAGE_TAG}\""
+echo "Or for a direct Helm deploy (bootstrap only):"
 echo "   TAG=${IMAGE_TAG} ./scripts/gitops-deploy.sh"