refactor: bootstrap/infra/ci separation (#27)

- Create bootstrap/ dir: cert-manager, traefik-routes, argo-rollouts,
  kargo, kargo-*-pipeline (not managed by Kargo promotion)
- infra/ now only: gitea, gitea-custom (promoted by Kargo)
- ci/ unchanged: gitea-runner (promoted by Kargo)
- Split kargo/credentials/ into dev/ and prod/ with separate ksops generators
- Remove kargo-credentials from AppSet (managed by Pulumi Go code)
- Update infra Warehouse: only gitea (was also argo-rollouts, cert-manager)
- Update infra Stage dev: only yaml-update for gitea version
- Fix test-env warehouse: valid subscription instead of empty array
- Update step numbers: bootstrap 1-5, infra 1-2

bootstrap/argo-rollouts/config.yaml

@@ -0,0 +1,13 @@
+{
+  "name": "argo-rollouts",
+  "namespace": "argo-rollouts",
+  "step": "3",
+  "source": {
+    "repoURL": "https://argoproj.github.io/argo-helm",
+    "chart": "argo-rollouts",
+    "targetRevision": "2.40.6"
+  },
+  "helm": {
+    "values": "dashboard:\n  enabled: true\n"
+  }
+}