Integrate generated Argo bootstrap with immutable CLI publication

[AntoineToussaint]

Problem

PR #32 closed #30, but the generated Argo bootstrap is not connected to the GitOps lifecycle merged in codefly-dev/cli#152. The checked-in deployment README still states that callers must perform the service-render, commit, revision update, and module-generation sequence manually until CLI #152 invokes it.

The two implementations currently disagree:

• the module generator requires service overlays at deployments/modules//services//overlays/;
• the CLI installs module renders under deployments/environments//modules/;
• the generator accepts only HTTPS/SSH repositories, while the CLI local qualification uses a disposable file Git remote;
• the CLI copies the generator's complete multi-environment kustomize tree during a single-environment render;
• the generator has no released promotable plugin output to consume and correctly rejects current Secret and Namespace output.

This leaves codefly-dev/mind#216 with no valid generation path. Hand-editing the copied manifests is explicitly forbidden.

Acceptance criteria

• Consume the CLI's canonical service render inventory and exact module/service graph instead of relying on an independently assumed layout.
• Use one shared owned-path contract with Complete GitOps rendering against the promotable plugin contract cli#156.
• Run generation only after the service snapshot has a reviewed immutable revision, and bind every Application to that revision.
• Expose a safe local qualification repository contract that Argo CD inside k3d can fetch while preserving exact revision checks.
• Let the CLI select one environment bootstrap without copying unrelated Applications or AppProjects.
• Consume and verify the released Core promotable-output contract from Release the promotable Kubernetes manifest contract core#103.
• Preserve rejection of missing/extra services, Kubernetes secret values, wildcard authority, mutable AWS revisions, unowned cluster resources, and incomplete managed-service handoffs.
• Add a real Mind-shaped integration test with users services accounts, cache, forge-edge, frontend, object-storage, store, and vault; prove auth-sidecar is rejected.
• Qualify exact routes and topology-derived default-deny NetworkPolicy exceptions for local and AWS.

Dependencies:

• Complete GitOps rendering against the promotable plugin contract cli#156
• Implement the promotable GitOps Kubernetes output profile service-go-grpc#42
• Implement the promotable GitOps Kubernetes output profile service-nextjs#31
• Implement the promotable GitOps Kubernetes output profile service-postgres#16
• Implement the promotable GitOps Kubernetes output profile service-redis#5
• Implement the promotable GitOps Kubernetes output profile service-s3#6
• Implement the promotable GitOps Kubernetes output profile service-vault#7

Blocks codefly-dev/mind#216.