Add Infisical Kubernetes operator (secrets-operator v0.11.1)

Phase 2 Step 1: controller-only, dedicated infisical-operator namespace,
hostAPI -> self-hosted instance, cluster-scoped, ServerSideApply for CRDs.
No InfisicalSecret CRs yet — operator sits idle until later UI config.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

argocd/application-infisical-operator.yaml

@@ -0,0 +1,35 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: infisical-operator
+  namespace: argocd
+spec:
+  destination:
+    namespace: infisical-operator
+    server: https://kubernetes.default.svc
+  project: default
+  # Single-source Helm: remote chart + inline values. (Multi-source $values ref
+  # caused the platform app to prune its own Application object on first sync.)
+  source:
+    repoURL: https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/
+    chart: secrets-operator
+    targetRevision: v0.11.1
+    helm:
+      valuesObject:
+        # Self-hosted API as the global default (chart default is Infisical Cloud).
+        hostAPI: https://infisical.chemavx.xyz/api
+        installCRDs: true
+        scopedRBAC: false        # cluster-scoped: watch all namespaces
+        scopedNamespaces: []
+        controllerManager:
+          replicas: 1
+        telemetry:
+          serviceMonitor:
+            enabled: false       # no Prometheus-Operator ServiceMonitor CRD in cluster
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true     # large CRD schemas exceed client-side annotation limit