Everything-is-an-app cutover: standalone apps + delete env/apps + secrets audit

[j-zimnowoda]

Parent

#3515

Design update (supersedes original §3/§8): enable flags live in AplCluster.spec.apps (env/settings/cluster.yaml), and the AplApp kind is removed. Gating still resolves from .Values.apps.<name>.enabled via the derived.gotmpl overlay-then-unset. See #3515 comment and ADR adr/2026-08-21-app-enable-flags-in-aplcluster.md.

What to build

Cut the remaining "standalone" core apps over to the new git-driven layout and finish the structural cutover. These apps share no cross-cutting managed setting beyond the universal four (useORCS, nodeSelector, version, globalPullSecret), so their values.managed.yaml carries only those universal injections.

Apps in this batch (all remaining core releases not covered by earlier batches), e.g.:
metrics-server, kyverno, policy-reporter, sealed-secrets, external-secrets, cnpg (+ barman plugin), linode-cfw, trivy, knative, kserve, rabbitmq, tekton, git-server, apl-operator, apl-harbor-operator, apl-gitea-operator, apl-keycloak-operator, otomi-operator, otomi-api, and any others still on the legacy path.

This batch also completes the cutover:

• Delete env/apps/ entirely once all apps are migrated, and remove the AplApp kind + its file-map entry (enablement now lives in AplCluster.spec.apps).
• Remove the legacy inline-values ArgoCD path and any now-dead per-app values/<app>/<app>.gotmpl translation files (keeping -raw.gotmpl files).
• Run the secrets audit: enumerate charts that only accept an inline secret (no existingSecret) and record them as a follow-up risk list; ensure all migrated value files are secret-free.

Acceptance criteria

• Every remaining core app reconciles Healthy in ArgoCD from its env/values/<ns>/<release>/{managed,custom}.yaml.
• env/apps/ is deleted and the AplApp kind + file-map entry removed; no app reads from env/apps/.
• Legacy inline-values path and dead per-app .gotmpl translation files removed; -raw.gotmpl files retained.
• Secrets audit completed: inline-secret-only charts enumerated; all value files verified secret-free.
• Existing installed: gating still works from AplCluster.spec.apps (env/settings/cluster.yaml) for all apps.

Blocked by

• Everything-is-an-app: pilot cert-manager end-to-end (app-of-apps + settings + values) #3571
• Everything-is-an-app: validate values.custom.yaml against vendor values.schema.json #3572
• Everything-is-an-app: render cert-manager -artifacts into git manifests (one object per file) #3573