feat: SOPS + age encrypted secrets structure

- .sops.yaml with 3 age keys (admin, dev, prod)
- infra/gitea/values/*.enc.yaml — per-env encrypted Helm values
- infra/kargo/values/*.enc.yaml — per-env encrypted Kargo admin secrets
- kargo/credentials/*.enc.yaml — per-env encrypted git credentials (ksops)
- infra/kargo-credentials/ — ArgoCD app for deploying Kargo creds via ksops
- All repoURLs point to deploy-app-kargo-private

Structure from deploy-app-kargo (reference), adapted for SOPS workflow

kargo/test-env/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - project.yaml
+  - warehouse.yaml
+  - stages/dev.yaml

kargo/test-env/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: test-env
+  labels:
+    kargo.akuity.io/project: "true"

kargo/test-env/project.yaml

@@ -0,0 +1,14 @@
+apiVersion: kargo.akuity.io/v1alpha1
+kind: Project
+metadata:
+  name: test-env
+---
+apiVersion: kargo.akuity.io/v1alpha1
+kind: ProjectConfig
+metadata:
+  name: test-env
+  namespace: test-env
+spec:
+  promotionPolicies:
+    - stageSelector: { name: dev }
+      autoPromotionEnabled: true

kargo/test-env/stages/dev.yaml

@@ -0,0 +1,45 @@
+apiVersion: kargo.akuity.io/v1alpha1
+kind: Stage
+metadata:
+  name: dev
+  namespace: test-env
+spec:
+  requestedFreight:
+    - origin:
+        kind: Warehouse
+        name: test-env-images
+      sources:
+        direct: true
+  promotionTemplate:
+    spec:
+      vars:
+        - name: gitopsRepo
+          value: https://github.com/Kargones/deploy-app-kargo-private.git
+        - name: targetBranch
+          value: test-env/stage/${{ ctx.stage }}
+      steps:
+        - uses: git-clone
+          config:
+            repoURL: ${{ vars.gitopsRepo }}
+            checkout:
+              - branch: main
+                path: ./src
+              - branch: ${{ vars.targetBranch }}
+                create: true
+                path: ./out
+        - uses: git-clear
+          config:
+            path: ./out
+        - uses: copy
+          config:
+            inPath: ./src/test-env
+            outPath: ./out/test-env
+        - uses: git-commit
+          as: commit
+          config:
+            path: ./out
+            message: "promote(test-env/${{ ctx.stage }}): freight ${{ ctx.targetFreight.name }}"
+        - uses: git-push
+          config:
+            path: ./out
+            targetBranch: ${{ vars.targetBranch }}

kargo/test-env/warehouse.yaml

@@ -0,0 +1,8 @@
+apiVersion: kargo.akuity.io/v1alpha1
+kind: Warehouse
+metadata:
+  name: test-env-images
+  namespace: test-env
+spec:
+  subscriptions: []
+  # TODO: Add container image subscriptions for test services