Mark ArgoCD bootstrap T05 done after live cluster apply

Record bootstrap evidence on 92.205.130.254 and note issue-core sync is
blocked until the ExternalSecret CRD is installed.

workplans/RAILIANCE-WP-0004-argocd-gitops-bootstrap.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Establish ArgoCD GitOps bootstrap contract"
 domain: railiance
 repo: railiance-platform
-status: blocked
+status: active
 owner: codex
 topic_slug: railiance
 planning_priority: high
@@ -218,7 +218,7 @@ file-reference workloads, and the OpenBao injector remains disabled.
 
 ```task
 id: RAILIANCE-WP-0004-T05
-status: blocked
+status: done
 priority: high
 ```
 
@@ -227,20 +227,19 @@ changes are merged to the Git source ArgoCD reads and, if the source repo is
 private, after an operator provides or materializes read-only repository
 credentials through the approved OpenBao/operator path.
 
-Blocked until the bootstrap files are available on the remote branch ArgoCD
-syncs and operator-owned repository credentials exist outside Git when needed.
+Applied 2026-06-19 on the live ArgoCD cluster (`92.205.130.254`, default
+`~/.kube/config`). `make argocd-bootstrap-dry-run` and
+`make argocd-bootstrap-deploy` succeeded. Repository registration was skipped
+because `railiance-platform` and `issue-core` Gitea repos are currently public.
+
+Post-bootstrap status:
+
+- `railiance-apps-root`: Synced / Healthy
+- `issue-core`: OutOfSync / Missing — sync fails because
+  `external-secrets.io/ExternalSecret` CRD is not installed on the cluster
+
 Do not paste credentials into the workplan, State Hub, or chat.
 
-Expected command sequence after credentials are available:
-
-```bash
-ARGOCD_REPOSITORY_SECRET=argocd/repositories/railiance-platform.repository.sops.yaml \
-  make argocd-repo-apply
-make argocd-bootstrap-dry-run
-make argocd-bootstrap-deploy
-make argocd-status
-```
-
 ### T06 - Notify first tenant
 
 ```task