Implement deterministic GitOps render, publish, and Argo observation

[AntoineToussaint]

Problem

Codefly has the pieces of a GitOps workflow but not the workflow itself:

• WorkspaceGitops declares repository URL/path/branch, but the CLI does not consume it.
• --render-only writes generated files without an atomic owned-tree inventory, stale-file cleanup, or a release digest.
• Generic VCS status/diff/commit/branch/push/tag operations exist, but are not connected to deployment promotion.
• Deploy results do not prove which Git revision Argo CD reconciled or whether it became Healthy.

This work depends on the direct-apply boundary in #151.

Acceptance criteria

Render

• Render into a temporary staging directory, validate it, then atomically replace only the declared owned destination.
• Emit a canonical inventory plus aggregate digest; delete stale previously-owned files without touching unowned files.
• Require digest-pinned images for promotable remote output.
• Reject Kubernetes Secret values, credentials, unsafe URLs, wildcard authority, unresolved placeholders, and cluster-scoped resources outside the declared contract.
• Support a module-wide render through both CLI and control-plane surfaces.

Publish

• Consume workspace.gitops repository/path/branch rather than hard-coded destinations.
• Produce an inspectable plan/diff before mutation.
• Create a signed commit on a promotion branch and open/update a PR; never force-push or silently commit unrelated changes.
• Require prepared mutation authority for commit/push/PR actions and return exact commit/tree identities.
• Keep production promotion review-driven; the CLI must not directly call the Kubernetes API.

Observe and recover

• Observe Argo CD sync, health, operation, and reconciled revision for the published commit.
• Fail if the observed revision differs, health times out, or resources are shared/outside the selected AppProject.
• Store evidence linking render digest, signed Git commit, PR/review, Argo revision, cluster identity, and final health.
• Define rollback as a reviewed Git revert/re-promotion and observe it through Argo CD.
• Prove the flow against the local k3d disposable-Git harness before remote qualification.