Declare Argo CD Core v3.5.3 on railiance01 and its resource bounds

Pinned core-install.yaml (sha256 1a87025d...c448) with a kustomize
resources patch for the four workloads. The unpatched pin diffs clean
against live; the resources patch is declared only, and its apply waits
on the founder in RAIL-EN-WP-0002-T02. SCOPE.md no longer says ArgoCD is
absent from railiance01.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

workplans/RAIL-EN-WP-0002-argocd-railiance01-declared-state.md

@@ -0,0 +1,90 @@
+---
+id: RAIL-EN-WP-0002
+type: workplan
+title: "Declare Argo CD Core on railiance01 and bound its resources"
+domain: financials
+repo: railiance-enablement
+status: active
+flavor: implementation
+owner: codex
+topic_slug: railiance
+created: "2026-09-21"
+updated: "2026-09-21"
+related:
+  - ArchitectureBlueprint-5.6
+  - RPF-WP-0043
+---
+
+# RAIL-EN-WP-0002 — Argo CD Core on railiance01: declared state
+
+Argo CD Core v3.5.3 was installed on railiance01 on 2026-09-21 as a direct
+`ADMINISTER @ realm:kubernetes/railiance01`, `activation=APPROVED` by the
+founder, performed by the custodian session
+(`the-custodian/docs/kubernetes-change-gate-decision.md`). ArgoCD is an S4
+concern (railiance-infra RAIL-HO-WP-0004 inventory), so its declared state
+lives here: `deploy/argocd/railiance01/`.
+
+## T01 — Declare the install
+
+```task
+id: RAIL-EN-WP-0002-T01
+status: done
+priority: high
+```
+
+Pin manifest URL and sha256 (`PIN`), kustomization, install and rollback
+commands (`README.md`), read-only `make argocd-fetch|render|diff`.
+
+**Outcome (2026-09-21):** fetched manifest sha256 matches the pin
+(`1a87025d…c448`, 34 objects). Read-only `kubectl diff --server-side -n argocd`
+of the unpatched pinned manifest against railiance01: **no diff**. So the
+declared base matches live exactly.
+
+## T02 — Apply resource requests and limits (live change, awaits founder)
+
+```task
+id: RAIL-EN-WP-0002-T02
+status: wait
+priority: high
+```
+
+Upstream core sets no resources, so all four pods are BestEffort (verified
+2026-09-21). `resources.yaml` declares:
+
+| Workload | Request cpu/mem | Limit cpu/mem | Idle use 2026-09-21 |
+|---|---|---|---|
+| application-controller (sts) | 50m / 256Mi | 1 / 1Gi | 2m / 23Mi |
+| repo-server (+ copyutil init 10m/32Mi, 100m/64Mi) | 25m / 128Mi | 1 / 1Gi | 1m / 19Mi |
+| applicationset-controller | 10m / 64Mi | 250m / 256Mi | 1m / 19Mi |
+| redis (+ secret-init init 10m/32Mi, 100m/64Mi) | 10m / 32Mi | 200m / 128Mi | 5m / 4Mi |
+
+Added requests: 95m CPU, 480Mi memory. Node requests before: 3320m (83%) CPU,
+8856Mi (55%) memory, so this fits. Pods become Burstable. Idle use is with 0
+Applications; revisit after phase B adoption.
+
+This is a **live change** (rolls all four pods). It is not taken in this
+session. On the founder's go-ahead, mode `ADMINISTER @ realm:kubernetes/railiance01`,
+`activation=APPROVED`:
+
+```bash
+make argocd-diff   # expect only resources on the 4 workloads
+kubectl kustomize deploy/argocd/railiance01 \
+  | ssh railiance01 'kubectl apply --server-side -n argocd -f -'
+ssh railiance01 'kubectl -n argocd rollout status sts/argocd-application-controller deploy/argocd-repo-server deploy/argocd-applicationset-controller deploy/argocd-redis'
+```
+
+Rollback (back to upstream BestEffort):
+
+```bash
+ssh railiance01 'kubectl apply --server-side -n argocd -f -' \
+  < deploy/argocd/railiance01/upstream/core-install.yaml
+```
+
+**Done when:** all four pods Ready with qosClass Burstable and `make argocd-diff`
+is empty.
+
+## Not in this workplan
+
+Phase B (AppProjects, root app, per-application adoption) and phase C
+(retire coulombcore's ArgoCD) each need their own founder go-ahead.
+Once phase B exists, ArgoCD's own manifest should move under GitOps too.