refactor: bootstrap/infra/ci separation (#27)

- Create bootstrap/ dir: cert-manager, traefik-routes, argo-rollouts,
  kargo, kargo-*-pipeline (not managed by Kargo promotion)
- infra/ now only: gitea, gitea-custom (promoted by Kargo)
- ci/ unchanged: gitea-runner (promoted by Kargo)
- Split kargo/credentials/ into dev/ and prod/ with separate ksops generators
- Remove kargo-credentials from AppSet (managed by Pulumi Go code)
- Update infra Warehouse: only gitea (was also argo-rollouts, cert-manager)
- Update infra Stage dev: only yaml-update for gitea version
- Fix test-env warehouse: valid subscription instead of empty array
- Update step numbers: bootstrap 1-5, infra 1-2

kargo/credentials/dev/ksops-generator.yaml

@@ -0,0 +1,12 @@
+apiVersion: viaduct.ai/v1
+kind: ksops
+metadata:
+  name: kargo-git-credentials
+  annotations:
+    config.kubernetes.io/function: |
+      exec:
+        path: ksops
+files:
+  - git-creds-infra.dev.enc.yaml
+  - git-creds-ci.dev.enc.yaml
+  - git-creds-test-env.dev.enc.yaml

kargo/credentials/ksops-generator.yaml

@@ -1,20 +0,0 @@
-# ksops generator: decrypts SOPS-encrypted K8s Secret manifests
-# ArgoCD repo-server must have ksops + sops + age installed
-#
-# Dev cluster uses: *.dev.enc.yaml
-# Prod cluster uses: *.prod.enc.yaml
-#
-# Which files to decrypt is controlled by the kustomization overlay
-# in the cluster-specific branch (infra/stage/dev or infra/stage/prod)
-apiVersion: viaduct.ai/v1
-kind: ksops
-metadata:
-  name: kargo-git-credentials
-  annotations:
-    config.kubernetes.io/function: |
-      exec:
-        path: ksops
-files:
-  - git-creds-infra.dev.enc.yaml
-  - git-creds-ci.dev.enc.yaml
-  - git-creds-test-env.dev.enc.yaml

kargo/credentials/prod/ksops-generator.yaml

@@ -1,5 +1,3 @@
-# ksops generator for PROD cluster
-# Replace ksops-generator.yaml on infra/stage/prod branch
 apiVersion: viaduct.ai/v1
 kind: ksops
 metadata:

kargo/credentials/prod/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+generators:
+  - ksops-generator.yaml