Generate least-privilege GitOps manifests (#30)

[AntoineToussaint]

Closes #30.

Summary

• Generate each Argo CD bootstrap from the consumer workspace, module topology, exact service inventory, and committed GitOps snapshot so starter identities and mutable targets cannot survive composition.
• Derive namespace-only AppProject authority and topology policies from the immutable child renders, rejecting missing/extra paths, cluster-scoped resources, placeholders, and Kubernetes Secrets before replacing the generated tree.
• Keep local dependencies in-cluster while rendering explicit AWS managed-service endpoints, CIDR egress, and external secret references at the module boundary.

Test plan

• go test -count=1 -race ./...
• go vet ./...
• staticcheck ./...
• golangci-lint run gitops.go main.go gitops_test.go
• node module/tools/base-integrity.mjs check
• node --test module/tools/base-integrity.test.mjs
• GOWORK=off go test -count=1 ./... in module/tools
• go test -count=1 ./pkg/cataloggen in module/services/accounts/code
• go test -count=1 ./... in module/services/auth-sidecar/code and module/services/store/code
• npm test, npm run lint, npm run build:plugin-packages, and npm run typecheck in module/services/frontend/code (lint has 18 existing React Compiler compatibility warnings and no errors)
• Codefly CI verify, sync-drift, lint, and compile phases
• Full Codefly/accounts integration tests: package tests pass, but runtime setup reuses a persisted Postgres schema at migration 82 while this checkout has no matching down migration (no migration found for version 82); no database state was deleted to work around it.
• golangci-lint run ./...: the changed-file lint is clean; the repository-wide invocation reports three existing errcheck findings in unchanged host/host.go and two govet findings in ignored node_modules/flatted.

External dependencies

• codefly-dev/core#101 must provide the versioned reference-only secret contract. This module rejects any resolved Kubernetes Secret in the selected immutable tree in the meantime.
• codefly-dev/cli#151 and codefly-dev/cli#152 must automate the render/commit/generate/publish sequence. The module now validates that sequence and fails closed when the selected revision is stale or incomplete.