ArgoCD was still tracking gitea.coulomb.social, which lags Forgejo after the
registry migration. Sync issue-core workload manifests from forgejo.coulomb.social
so backend ConfigMap updates land on CoulombCore.
Also allow forgejo.coulomb.social in railiance-tenants AppProject sourceRepos.
Define platform-owned AppProjects, root app-of-apps, repository registration
templates, and tenant onboarding docs so issue-core can deploy via ArgoCD.
Ignore encrypted repository secrets locally and cross-link OpenBao delivery
guidance with the new GitOps contract.
