Darkmatter gitops conventions

darkmatter/gitops is the single source of truth for the k3s cluster: ArgoCD app-of-apps, Helm values, KSOPS secrets, network policies, cloudflared routes. A change is real only when it's committed here — everything else is drift.

The prime rule

Never mutate the cluster imperatively. No kubectl apply/edit/patch, no helm upgrade, no imperative restarts. If a live object disagrees with the repo, the repo wins and the object is the bug.

• Reload a deployment: bump its pod-template config-rev annotation in the manifest and commit — not kubectl rollout restart.
• Force ArgoCD to reconcile now: set the arc.darkmatter.io/reconcile-at: "<current UTC timestamp>" annotation in the manifest.
• Roll back: git revert the offending commit and push. ArgoCD converges. Never "fix forward" live.