Restructure dev ArgoCD to GitOps bootstrap (split roots, drop kubectl provider, auto-seed secrets)

[basebandit]

Why

Addresses three smells in the initial dev setup:

1. Terraform owned in-cluster state in the same root as the cluster → forced two-phase apply and a fragile provider-from-resource config.
2. gavinbunney/kubectl community provider dependency.
3. Manual SecretsManager seeding of ArgoCD bootstrap secrets.

What changed

• modules/argocd gutted to a lean bootstrap installer: argo-cd + two core kubernetes_secrets (repo creds + admin, official provider) + root app-of-apps via the argocd-apps Helm chart. No kubectl provider, no templates.
• modules/pod-identity-role (new) — reusable AWS-only Pod Identity role + association.
• environments/dev/ (cluster root) is now AWS-only → single-pass apply. Adds pod-identity.tf (external-secrets + image-updater IAM) and secrets.tf (Terraform generates + stores admin password, server key, and an ed25519 deploy key in Secrets Manager).
• environments/dev/bootstrap/ (new root) installs ArgoCD, reading the cluster via remote state and secrets via aws_secretsmanager_secret_version — providers resolve from the existing cluster, so no two-phase.
• GitOps: external-secrets, image-updater, and the ClusterSecretStore now sync from git under a dev-platform-apps project, instead of being installed by Terraform.

Apply flow

1. environments/dev — terraform apply (single pass)
2. Register terraform output -raw argocd_repo_deploy_public_key as a GitHub deploy key (write, for Image Updater write-back)
3. environments/dev/bootstrap — terraform apply

Verify

• Bump the external-secrets chart version (0.10.7 placeholder) to current stable.
• SSH private key lands in Terraform state — S3 backend stays encrypted.