Declare Argo CD Core v3.5.3 on railiance01 and its resource bounds

Pinned core-install.yaml (sha256 1a87025d...c448) with a kustomize
resources patch for the four workloads. The unpatched pin diffs clean
against live; the resources patch is declared only, and its apply waits
on the founder in RAIL-EN-WP-0002-T02. SCOPE.md no longer says ArgoCD is
absent from railiance01.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

deploy/argocd/railiance01/kustomization.yaml

@@ -0,0 +1,10 @@
+# Declared state of Argo CD Core on railiance01 (namespace argocd).
+# Upstream manifest is fetched and sha256-verified by `make argocd-fetch`
+# into upstream/ (gitignored); see PIN and README.md. Like upstream, the
+# render carries no namespace: apply it with `-n argocd`.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - upstream/core-install.yaml
+patches:
+  - path: resources.yaml