Add ArgoCD GitOps bootstrap contract for railiance01

Define platform-owned AppProjects, root app-of-apps, repository registration
templates, and tenant onboarding docs so issue-core can deploy via ArgoCD.
Ignore encrypted repository secrets locally and cross-link OpenBao delivery
guidance with the new GitOps contract.

.gitignore

@@ -10,5 +10,9 @@ helm/*.yaml
 !helm/*-networkpolicies.yaml
 !helm/*-databases.yaml
 
+# ArgoCD repository credentials — encrypt locally, never commit
+argocd/repositories/*.repository.sops.yaml
+!argocd/repositories/*.repository.sops.yaml.template
+
 # Kubeconfig
 *.kubeconfig