stage/prod: bootstrap apps only, prod ksops keys

Bootstrap: cert-manager kargo kargo-infra-pipeline kargo-ci-pipeline kargo-test-env-pipeline kargo-credentials
Other apps arrive via Kargo promotion (dev → test → PR → prod)

infra/traefik-routes/manifests/tls-store.yaml

@@ -1,10 +0,0 @@
-# Default TLS store — uses wildcard-tls from kube-system as default cert.
-# All IngressRoutes with tls: {} will use this certificate.
-apiVersion: traefik.io/v1alpha1
-kind: TLSStore
-metadata:
-  name: default
-  namespace: kube-system
-spec:
-  defaultCertificate:
-    secretName: wildcard-tls