refactor: bootstrap/infra/ci separation (#27)

- Create bootstrap/ dir: cert-manager, traefik-routes, argo-rollouts,
  kargo, kargo-*-pipeline (not managed by Kargo promotion)
- infra/ now only: gitea, gitea-custom (promoted by Kargo)
- ci/ unchanged: gitea-runner (promoted by Kargo)
- Split kargo/credentials/ into dev/ and prod/ with separate ksops generators
- Remove kargo-credentials from AppSet (managed by Pulumi Go code)
- Update infra Warehouse: only gitea (was also argo-rollouts, cert-manager)
- Update infra Stage dev: only yaml-update for gitea version
- Fix test-env warehouse: valid subscription instead of empty array
- Update step numbers: bootstrap 1-5, infra 1-2

kargo/test-env/warehouse.yaml

@@ -4,5 +4,11 @@ metadata:
   name: test-env-images
   namespace: test-env
 spec:
-  subscriptions: []
-  # TODO: Add container image subscriptions for test services
+  # Placeholder: no subscriptions yet.
+  # When test services are added, subscribe to their container images here.
+  subscriptions:
+    - chart:
+        repoURL: https://dl.gitea.com/charts
+        name: gitea
+        semverConstraint: ">=0.0.1"
+        discoveryLimit: 1