Add cluster-side connect operations to the ArgoCD skill

Fold the operational half of ArgoCD work into this skill, which until now
covered only authoring the Copier-templated repo. The two never overlapped:
authoring edits files in git, connecting applies objects to a cluster.

- Add references/connecting-a-repo.md: host-key trust, repository Secret
  registration with its project-scoping decision table, bootstrap apply
  ordering, SSO RBAC, prerequisites, and verification commands.
- Add references/connect-env-vars.md: layered .env loading, variable table,
  CLI flags, and SSH deploy-key rules.
- Add SKILL.md section 11 plus scope-routing rows, and state the split:
  sections 1-10 author, section 11 operates.
- Map the numbered cluster/0000-bootstrap layout onto the cluster/argocd
  layout, since the connect scripts reference those folder names directly.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

SKILL.md

@@ -1,17 +1,17 @@
 ---
 name: development-gitops-argo-cd
 description: >
-  Create, review, refactor, debug, and maintain GitOps repositories where ArgoCD syncs
-  cluster state from a Copier-templated Git repo — app-of-apps ArgoCD Application manifests
-  under cluster/argocd/, Helm values.yaml.jinja templates under cluster/resources/, Jinja2
-  conditional directory names used as feature flags, copier.yaml variable schemas, and
-  per-environment copier-answers.yaml files. Use when adding a new operator, database, or
-  workload to a cluster; editing sync policies, prune/self-heal, finalizers, or destination
-  namespaces; wiring container image address/tag through Copier variables into Helm values;
-  enabling or disabling a feature flag for one environment; comparing environment drift or
-  running copier update to re-render a deployed environment; or debugging an app stuck
-  OutOfSync, a template that fails to render, or blank lines that break rendered YAML — even
-  when the user only names their repository (for example CogArchHubGitOps) instead of saying
+  Create, debug, and maintain GitOps repositories where ArgoCD syncs cluster state from a
+  Copier-templated Git repo — app-of-apps Application manifests under cluster/argocd/, Helm
+  values.yaml.jinja under cluster/resources/, Jinja2 conditional directory names used as
+  feature flags, copier.yaml schemas, per-environment copier-answers.yaml — and connect the
+  rendered repo to a live cluster. Use when adding an operator, database, or workload;
+  editing sync policies, finalizers, or destination namespaces; wiring image address/tag
+  through Copier variables into Helm values; toggling a feature flag for one environment;
+  running copier update; registering the repository Secret, applying the AppProject and
+  app-of-apps bootstrap, trusting the git host key, or granting SSO read access; or debugging
+  an app stuck OutOfSync, a failed render, or blank lines that break rendered YAML — even
+  when the user only names their repository (e.g. CogArchHubGitOps) instead of saying
   "GitOps" or "ArgoCD".
 license: Proprietary
 metadata:
@@ -32,6 +32,12 @@ The rules here are repo-agnostic. `references/cogarchhubgitops-reference.md` rec
 complete, concrete instance of every pattern (bands in use, flag names, global settings) —
 read it when working in that repository, or as a worked example when standing up a new one.
 
+Two distinct jobs live in this skill. **Authoring** — sections 1–10 — produces the repository:
+templates, flags, values, all of it files in git. **Operating** — section 11 — hands a
+rendered repository to a live cluster: repository credentials, bootstrap manifests, RBAC. The
+first never touches a cluster; the second never edits a template. If you are reaching for
+`kubectl`, you are in section 11.
+
 ## Scope routing
 
 Pick the reference file that matches the change; do not load all of them.
@@ -43,6 +49,8 @@ Pick the reference file that matches the change; do not load all of them.
 | A `values.yaml.jinja` — image wiring, `global` block, env vars, probes, replicas | `references/helm-values.md` |
 | A `<env>/copier-answers.yaml` — feature flags, image tags, drift, `copier update` | `references/environments.md` |
 | Adding a whole new resource across all three layers at once | `references/adding-a-resource.md` |
+| Connecting a rendered repo to a cluster — repo Secret, bootstrap apply, host key, SSO RBAC | `references/connecting-a-repo.md` |
+| Variables and flags for the connect operations | `references/connect-env-vars.md` |
 | CogArchHubGitOps specifically — bands in use, flag names, global settings | `references/cogarchhubgitops-reference.md` |
 
 ## 1. Canonical repository shape
@@ -250,3 +258,32 @@ Before committing any resource addition or rename:
   wrong values break `copier update`.
 - Skipping the render-and-diff step after editing an answer file — drift between answers and
   rendered output produces unexplained cluster state.
+
+## 11. Connecting the repo to a cluster
+
+Authoring stops at a rendered repository. Getting ArgoCD to *read* it is a separate,
+cluster-side job, driven by the `.scripts/argo-cd/` shell module:
+
+```bash
+task argo-cd:0000-trust-repo-host      # once per git host — SSH known-hosts
+task argo-cd:0100-connect-one          # preflight → repository Secret → bootstrap apply
+task argo-cd:0200-grant-sso-readonly   # SSO users can see Applications
+```
+
+Full walkthrough, decision tables, and verification commands:
+`references/connecting-a-repo.md`. Variables and flags: `references/connect-env-vars.md`.
+
+Three things about this half are easy to get wrong:
+
+- **It assumes ArgoCD is already installed.** Preflight only checks that the namespace
+  exists; nothing here installs ArgoCD.
+- **The repo must be pushed before connecting.** The bootstrap manifests are applied from
+  local disk, but they point ArgoCD at a `repoURL` and `path` *in Git*. An unpushed render
+  produces an app-of-apps that cannot find its own path.
+- **Cluster folder names are a contract.** The connect scripts reference the rendered
+  bootstrap directory by name. Renaming cluster folders in the template without updating the
+  step scripts breaks onboarding — see `references/connecting-a-repo.md` §7, which also maps
+  the numbered `cluster/0000-bootstrap` layout onto the `cluster/argocd/` layout used above.
+
+Configuration for these operations lives in `.env` layers, which are **tooling inputs**.
+Never let their values reach the deployed `cluster/**` manifests.