ci: split GitOps state into cloud-host-gitops repo, add Sealed Secrets, fix pipeline auth

- Workflow now pushes image tags to the separate cloud-host-gitops repo
  (no more CI loop risk) and authenticates via CI_TOKEN secret
- Fix undefined ${REGISTRY} in Kaniko jobs, add concurrency group,
  targeted tag update, and mounted kaniko-harbor-auth docker config
- Argo CD Application is now multi-source (chart from cloud-host,
  values from cloud-host-gitops)
- Remove plaintext runner token and proxy credentials from manifests;
  secrets are now SealedSecrets in the gitops repo

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/trigger-platform-build.sh

@@ -70,9 +70,8 @@ EOF
 echo "==> Waiting for build job..."
 kubectl -n "${NAMESPACE}" wait --for=condition=complete "job/${JOB_NAME}" --timeout=45m
 
-echo "==> Updating values-abrban.yaml tag to ${IMAGE_TAG}"
-sed -i.bak "s|tag: \".*\"|tag: \"${IMAGE_TAG}\"|g" "${ROOT}/gitops/platform/values-abrban.yaml"
-rm -f "${ROOT}/gitops/platform/values-abrban.yaml.bak"
-
-echo "==> Build complete. Deploy with:"
+echo "==> Build complete (tag=${IMAGE_TAG})."
+echo "To deploy via GitOps, commit the tag in the cloud-host-gitops repo:"
+echo "   platform/values-abrban.yaml → images.backend.tag / images.frontend.tag = \"${IMAGE_TAG}\""
+echo "Or for a direct Helm deploy (bootstrap only):"
 echo "   TAG=${IMAGE_TAG} ./scripts/gitops-deploy.sh"