fix(infisical): single-source Helm with inline values

The multi-source variant ($values git ref) caused the infisical app to
prune its own Application object on first sync (controller pruned
Application/argocd/infisical, orphaning the workloads). Switch to a
single-source Helm app with inline valuesObject (same chart 1.9.0, same
DB/Redis passwords) and drop the hand-written tracking-id annotation.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

argocd/application-infisical.yaml

@@ -3,23 +3,71 @@ kind: Application
 metadata:
   name: infisical
   namespace: argocd
-  annotations:
-    argocd.argoproj.io/tracking-id: infisical:argoproj.io/Application:argocd/infisical
 spec:
   destination:
     namespace: infisical
     server: https://kubernetes.default.svc
   project: default
-  sources:
-    - repoURL: https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/
-      chart: infisical-standalone
-      targetRevision: 1.9.0
-      helm:
-        valueFiles:
-          - $values/infisical/values.yaml
-    - repoURL: https://git.chemavx.xyz/chemavx/k8s-manifests
-      targetRevision: main
-      ref: values
+  # Single-source Helm: remote chart + inline values. (Multi-source $values ref
+  # caused the app to prune its own Application object on first sync.)
+  source:
+    repoURL: https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/
+    chart: infisical-standalone
+    targetRevision: 1.9.0
+    helm:
+      valuesObject:
+        # Crown-jewel secrets (ENCRYPTION_KEY, AUTH_SECRET, SITE_URL) are NOT here —
+        # they live in the out-of-band 'infisical-secrets' Secret (kubectl, IgnoreExtraneous).
+        # Postgres/Redis passwords below guard ClusterIP-only services in the isolated
+        # infisical namespace; the DB stores only ciphertext (useless without ENCRYPTION_KEY).
+        infisical:
+          enabled: true
+          replicaCount: 1
+          kubeSecretRef: infisical-secrets
+          autoBootstrap:
+            enabled: false
+          image:
+            tag: "v0.158.0"
+            pullPolicy: IfNotPresent
+          resources:
+            limits:
+              memory: 1000Mi
+            requests:
+              cpu: 350m
+        ingress:
+          enabled: true
+          nginx:
+            enabled: false
+          ingressClassName: traefik
+          hostName: infisical.chemavx.xyz
+          annotations:
+            cert-manager.io/cluster-issuer: letsencrypt-prod
+            traefik.ingress.kubernetes.io/router.entrypoints: websecure
+          tls:
+            - secretName: infisical-tls
+              hosts:
+                - infisical.chemavx.xyz
+        postgresql:
+          enabled: true
+          name: postgresql
+          fullnameOverride: postgresql
+          auth:
+            username: infisical
+            password: "eeb3d0ec1a98f8582253e74b8f22f7ad9f4b56eaf94679aa"
+            database: infisicalDB
+          primary:
+            persistence:
+              enabled: true
+              storageClass: local-path
+              size: 8Gi
+        redis:
+          enabled: true
+          name: redis
+          fullnameOverride: redis
+          architecture: standalone
+          usePassword: true
+          auth:
+            password: "b10e20323896054ddacbafffa6b3d71b350c826e6ce3e06f"
   syncPolicy:
     automated:
       prune: true

infisical/values.yaml

@@ -1,56 +0,0 @@
-# Infisical platform (Phase 1) — chart: infisical-standalone 1.9.0 (Infisical v0.158.0)
-# Crown-jewel secrets (ENCRYPTION_KEY, AUTH_SECRET, SITE_URL) are NOT here — they live
-# in the out-of-band 'infisical-secrets' Secret (kubectl, IgnoreExtraneous).
-# Postgres/Redis passwords below guard ClusterIP-only services in the isolated infisical
-# namespace; the DB stores only ciphertext (useless without ENCRYPTION_KEY).
-infisical:
-  enabled: true
-  replicaCount: 1
-  kubeSecretRef: infisical-secrets
-  autoBootstrap:
-    enabled: false
-  image:
-    tag: "v0.158.0"
-    pullPolicy: IfNotPresent
-  resources:
-    limits:
-      memory: 1000Mi
-    requests:
-      cpu: 350m
-
-ingress:
-  enabled: true
-  nginx:
-    enabled: false
-  ingressClassName: traefik
-  hostName: infisical.chemavx.xyz
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-prod
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-  tls:
-    - secretName: infisical-tls
-      hosts:
-        - infisical.chemavx.xyz
-
-postgresql:
-  enabled: true
-  name: postgresql
-  fullnameOverride: postgresql
-  auth:
-    username: infisical
-    password: "eeb3d0ec1a98f8582253e74b8f22f7ad9f4b56eaf94679aa"
-    database: infisicalDB
-  primary:
-    persistence:
-      enabled: true
-      storageClass: local-path
-      size: 8Gi
-
-redis:
-  enabled: true
-  name: redis
-  fullnameOverride: redis
-  architecture: standalone
-  usePassword: true
-  auth:
-    password: "b10e20323896054ddacbafffa6b3d71b350c826e6ce3e06f"