stage/prod: bootstrap apps only, prod ksops keys

Bootstrap: cert-manager kargo kargo-infra-pipeline kargo-ci-pipeline kargo-test-env-pipeline kargo-credentials
Other apps arrive via Kargo promotion (dev → test → PR → prod)

infra/traefik-routes/manifests/kargo-transport.yaml

@@ -1,8 +0,0 @@
-# ServersTransport to skip TLS verification for Kargo backend (self-signed cert)
-apiVersion: traefik.io/v1alpha1
-kind: ServersTransport
-metadata:
-  name: kargo-skip-verify
-  namespace: kargo
-spec:
-  insecureSkipVerify: true