[noels]

GIT-26. Prepares the self-managed Argo CD add-on for the 2.13 → 3.5.3 (chart 10.9.2) upgrade.

• addons-argocd syncs with ServerSideApply=true. From 3.3 the ApplicationSet CRD (~4 MB) is too large for client-side apply ("Too long" last-applied annotation), so a self-upgrade would fail midway.
• rollout-extension v0.3.4 → v0.4.0. Argo CD 3.5 moved the UI to React 19, and extensions must be rebuilt.

Rehearsed on KinD along ivylen's exact path:

1. A hub seeded at chart 7.7.12 (v2.13.2), catalogue pinned to 7.7.12, add-ons metallb, cert-manager, external-secrets, velero and velero-ui.
2. This change applied while still on 2.13: the argo-cd app syncs Synced/Healthy with SSA.
3. Pin removed: self-upgrade to v3.5.3, rolled out in ~40s. Results:
   • All apps Synced/Healthy (except the unrelated, pre-existing addons-mariadb-operator merge-of-one error). Resource counts unchanged for every app except argo-cd (+4: NetworkPolicies, plus the redis secret-init hook).
   • ApplicationSet CRD (4 MB) applied via SSA.
   • /api/version reports v3.5.3; the UI returns 200; the extension installed and extensions.js returns 200.
   • Label → annotation tracking: after a sync on 3.5 the resources carry argocd.argoproj.io/tracking-id, with nothing pruned.
   • New chart NetworkPolicies: the server allows any ingress (LB/UI unaffected); repo-server and redis only accept Argo components.

Nothing changes on ivylen until its 7.7.12 pin is removed in gitops-private (next PR, after this merges).

🤖 Generated with Claude Code