ci: split GitOps state into cloud-host-gitops repo, add Sealed Secrets, fix pipeline auth

- Workflow now pushes image tags to the separate cloud-host-gitops repo
  (no more CI loop risk) and authenticates via CI_TOKEN secret
- Fix undefined ${REGISTRY} in Kaniko jobs, add concurrency group,
  targeted tag update, and mounted kaniko-harbor-auth docker config
- Argo CD Application is now multi-source (chart from cloud-host,
  values from cloud-host-gitops)
- Remove plaintext runner token and proxy credentials from manifests;
  secrets are now SealedSecrets in the gitops repo

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/gitops-deploy.sh

@@ -5,9 +5,17 @@ set -euo pipefail
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 NAMESPACE="${NAMESPACE:-cloudhost}"
 RELEASE="${RELEASE:-cloudhost}"
-VALUES="${VALUES:-${ROOT}/gitops/platform/values-abrban.yaml}"
+# Production values now live in the cloud-host-gitops repo (platform/values-abrban.yaml).
+VALUES="${VALUES:-${ROOT}/../cloud-host-gitops/platform/values-abrban.yaml}"
 TAG="${TAG:-}"
 
+if [[ ! -f "${VALUES}" ]]; then
+  echo "ERROR: values file not found: ${VALUES}" >&2
+  echo "Clone the GitOps repo next to this one, or pass VALUES=/path/to/values-abrban.yaml:" >&2
+  echo "  git clone https://git.abrban.com/abrban/cloud-host-gitops.git" >&2
+  exit 1
+fi
+
 if [[ -z "${TAG}" ]]; then
   TAG="$(grep -E '^\s+tag:' "${VALUES}" | head -1 | sed 's/.*tag: *"\?\([^"]*\)"\?.*/\1/')"
 fi