feat: SOPS + age encrypted secrets structure

- .sops.yaml with 3 age keys (admin, dev, prod)
- infra/gitea/values/*.enc.yaml — per-env encrypted Helm values
- infra/kargo/values/*.enc.yaml — per-env encrypted Kargo admin secrets
- kargo/credentials/*.enc.yaml — per-env encrypted git credentials (ksops)
- infra/kargo-credentials/ — ArgoCD app for deploying Kargo creds via ksops
- All repoURLs point to deploy-app-kargo-private

Structure from deploy-app-kargo (reference), adapted for SOPS workflow

kargo/ci/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - project.yaml
+  - warehouse.yaml
+  - stages/dev.yaml
+  - stages/prod.yaml
+  - verification/runner-health.yaml

kargo/ci/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ci
+  labels:
+    kargo.akuity.io/project: "true"

kargo/ci/project.yaml

@@ -0,0 +1,16 @@
+apiVersion: kargo.akuity.io/v1alpha1
+kind: Project
+metadata:
+  name: ci
+---
+apiVersion: kargo.akuity.io/v1alpha1
+kind: ProjectConfig
+metadata:
+  name: ci
+  namespace: ci
+spec:
+  promotionPolicies:
+    - stageSelector: { name: dev }
+      autoPromotionEnabled: true
+    - stageSelector: { name: prod }
+      autoPromotionEnabled: true

kargo/ci/stages/dev.yaml

@@ -0,0 +1,54 @@
+apiVersion: kargo.akuity.io/v1alpha1
+kind: Stage
+metadata:
+  name: dev
+  namespace: ci
+spec:
+  requestedFreight:
+    - origin:
+        kind: Warehouse
+        name: ci-images
+      sources:
+        direct: true
+  promotionTemplate:
+    spec:
+      vars:
+        - name: gitopsRepo
+          value: https://github.com/Kargones/deploy-app-kargo-private.git
+        - name: targetBranch
+          value: ci/stage/${{ ctx.stage }}
+      steps:
+        - uses: git-clone
+          config:
+            repoURL: ${{ vars.gitopsRepo }}
+            checkout:
+              - branch: main
+                path: ./src
+              - branch: ${{ vars.targetBranch }}
+                create: true
+                path: ./out
+        - uses: git-clear
+          config:
+            path: ./out
+        - uses: copy
+          config:
+            inPath: ./src/ci
+            outPath: ./out/ci
+        - uses: yaml-update
+          config:
+            path: ./out/ci/gitea-runner/manifests/runner.yaml
+            updates:
+              - key: spec.template.spec.containers.0.image
+                value: gitea/act_runner:${{ imageFrom("gitea/act_runner").Tag }}
+        - uses: git-commit
+          as: commit
+          config:
+            path: ./out
+            message: "promote(ci/${{ ctx.stage }}): act_runner ${{ imageFrom(\"gitea/act_runner\").Tag }}"
+        - uses: git-push
+          config:
+            path: ./out
+            targetBranch: ${{ vars.targetBranch }}
+  verification:
+    analysisTemplates:
+      - name: runner-health

kargo/ci/stages/prod.yaml

@@ -0,0 +1,64 @@
+apiVersion: kargo.akuity.io/v1alpha1
+kind: Stage
+metadata:
+  name: prod
+  namespace: ci
+spec:
+  requestedFreight:
+    - origin:
+        kind: Warehouse
+        name: ci-images
+      sources:
+        stages:
+          - dev
+  promotionTemplate:
+    spec:
+      vars:
+        - name: gitopsRepo
+          value: https://github.com/Kargones/deploy-app-kargo-private.git
+        - name: sourceBranch
+          value: ci/stage/dev
+        - name: targetBranch
+          value: ci/stage/prod
+      steps:
+        - uses: git-clone
+          config:
+            repoURL: ${{ vars.gitopsRepo }}
+            checkout:
+              - branch: ${{ vars.sourceBranch }}
+                path: ./src
+              - branch: ${{ vars.targetBranch }}
+                create: true
+                path: ./out
+        - uses: git-clear
+          config:
+            path: ./out
+        - uses: copy
+          config:
+            inPath: ./src/ci
+            outPath: ./out/ci
+        - uses: git-commit
+          as: commit
+          config:
+            path: ./out
+            message: "promote(ci/prod): act_runner ${{ imageFrom(\"gitea/act_runner\").Tag }}"
+        - uses: git-push
+          as: push
+          config:
+            path: ./out
+            generateTargetBranch: true
+        - uses: git-open-pr
+          as: open-pr
+          config:
+            repoURL: ${{ vars.gitopsRepo }}
+            sourceBranch: ${{ outputs.push.branch }}
+            targetBranch: ${{ vars.targetBranch }}
+            createTargetBranch: true
+            title: "promote(ci/prod): act_runner ${{ imageFrom(\"gitea/act_runner\").Tag }}"
+            description: |
+              ## Kargo Promotion — CI
+              **Image:** gitea/act_runner:${{ imageFrom("gitea/act_runner").Tag }}
+        - uses: git-wait-for-pr
+          config:
+            repoURL: ${{ vars.gitopsRepo }}
+            prNumber: ${{ outputs['open-pr'].pr.id }}

kargo/ci/verification/runner-health.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AnalysisTemplate
+metadata:
+  name: runner-health
+  namespace: ci
+spec:
+  metrics:
+    - name: runner-deployment-exists
+      provider:
+        job:
+          spec:
+            backoffLimit: 0
+            template:
+              spec:
+                serviceAccountName: kargo-verifier
+                restartPolicy: Never
+                containers:
+                  - name: check
+                    image: alpine/k8s:1.35.1
+                    command: ["/bin/sh", "-c"]
+                    args:
+                      - |
+                        echo "Checking gitea-runner deployment..."
+                        kubectl get deployment gitea-runner -n gitea-runner -o jsonpath='{.metadata.name}' && echo " exists" || exit 1
+                        echo "Runner health check passed"

kargo/ci/warehouse.yaml

@@ -0,0 +1,11 @@
+apiVersion: kargo.akuity.io/v1alpha1
+kind: Warehouse
+metadata:
+  name: ci-images
+  namespace: ci
+spec:
+  subscriptions:
+    - image:
+        repoURL: gitea/act_runner
+        semverConstraint: ">=0.2.0"
+        discoveryLimit: 5