feat(ci): pivot to ArgoCD GitOps, fix Traefik ingress after real-cluster check

Direct SSH access to the actual clusters (node1-3 "prod" HA, dev-k8s-1-3
"dev") revealed two things that made the previous design wrong:

1. Neither cluster has vncmail/vnc-ca namespaces or a bulwark ingress at
   all - the "live sandbox" referenced in this repo's docs/manifests was
   never actually applied anywhere. Both ingress.yaml's ingressClassName
   (public) and cert-manager issuer (letsencrypt-prod) were also wrong:
   both clusters run Traefik (class is literally named `traefik`), and
   only dev-k8s has any ClusterIssuer at all (`letsencrypt-staging`).
   node1-3 has zero ClusterIssuers configured.

2. dev-k8s already has ArgoCD installed, idle, zero Applications - more
   idiomatic to use it than have GitLab Runner execute kubectl directly.

Pivots .gitlab-ci.yml: build+push image, then commit the tag into a small
per-overlay Component (overlays/{dev,prod}/image-tag/) that ArgoCD's
Application watches - CI never touches the cluster, only the registry and
this repo. dev's Application (vncmail-dev) is registered and applied
already (manual sync for now, until the one-time namespace secret
bootstrap is done - see VNCMAIL-SETUP.md). prod's Application is
scaffolded in deploy/argocd/ but deliberately not applied - it targets a
different cluster (node1-3) that isn't registered with ArgoCD yet, and
there's still no real prod hostname/Stalwart/ClusterIssuer.

Fixes base/ingress.yaml to the real ingressClassName: traefik (was the
nginx-style `public`, which doesn't exist on either cluster) and gives
each overlay its own cert-manager issuer patch instead of one hardcoded
value, since dev and prod need different (or, for prod, nonexistent)
issuers.

deploy/k8s/overlays/prod/image-tag/kustomization.yaml

@@ -0,0 +1,12 @@
+# Owned by CI (the bump-prod job in .gitlab-ci.yml), not by hand — same
+# reasoning as overlays/dev/image-tag/. Starts pointed at an obviously-fake
+# tag on purpose: nothing has been promoted yet, and vncmail-prod's ArgoCD
+# Application has manual sync anyway, so this being "wrong" doesn't deploy
+# anything wrong — it just means there's nothing to sync until a real
+# `git push` to main updates it.
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+images:
+  - name: ghcr.io/brvncde-dotcom/vncmail-plus-dev
+    newName: registry.gitlab.vnc.biz/gitlab-instance-b9b5cf2f/vncmail-plus
+    newTag: not-yet-promoted

deploy/k8s/overlays/prod/kustomization.yaml

@@ -10,12 +10,12 @@ patches:
   - path: patch-ingress.yaml
   - path: patch-deployment.yaml
 
-# NOT MEANT TO BE APPLIED AS COMMITTED. Scaffolding only (see the pipeline
-# plan's Phase C/D) — the tag below is an obviously-invalid placeholder;
-# the real promote job (.gitlab-ci.yml) resolves and pins an actual digest at
-# deploy time via `kubectl set image`, it never trusts whatever is checked
-# in here.
-images:
-  - name: ghcr.io/brvncde-dotcom/vncmail-plus-dev
-    newName: registry.gitlab.vnc.biz/gitlab-instance-b9b5cf2f/vncmail-plus
-    newTag: not-yet-promoted
+components:
+  - image-tag
+
+# NOT MEANT TO BE SYNCED AS COMMITTED. Scaffolding only (see the pipeline
+# plan's Phase C/D) — image-tag/'s placeholder tag is obviously-invalid on
+# purpose. The bump-prod job in .gitlab-ci.yml keeps that tag pointed at
+# whatever's already on dev once main advances, but vncmail-prod's ArgoCD
+# Application has manual sync — a human still has to click Sync (or
+# `argocd app sync vncmail-prod`) for any of this to actually apply.

deploy/k8s/overlays/prod/patch-ingress.yaml

@@ -3,6 +3,12 @@
 # deliberately unresolvable: applying this overlay as committed will not
 # issue a cert or route traffic anywhere. Replace both occurrences below,
 # and the matching TLS secretName, before Phase D (first real prod deploy).
+#
+# Targets node1-3 (the HA "prod" cluster). Deliberately does NOT override
+# base's `cert-manager.io/cluster-issuer: CHANGEME` — node1-3 has ZERO
+# ClusterIssuers configured today (confirmed via direct access). A human
+# needs to create a real one there (ACME account, DNS-01 or HTTP-01 solver)
+# before this can be anything but a placeholder.
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata: