stage/prod: bootstrap apps only, prod ksops keys

Bootstrap: cert-manager kargo kargo-infra-pipeline kargo-ci-pipeline kargo-test-env-pipeline kargo-credentials
Other apps arrive via Kargo promotion (dev → test → PR → prod)

infra/gitea-custom/manifests/disable-cache.yaml

@@ -1,16 +0,0 @@
-# Override Gitea cache/session to use memory (no redis/valkey)
-# Mount this ConfigMap as /data/gitea/conf/app.ini override
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: gitea-disable-cache
-  namespace: gitea
-data:
-  _10-cache.ini: |
-    [cache]
-    ENABLED = false
-    ADAPTER = memory
-    INTERVAL = 0
-
-    [session]
-    PROVIDER = memory