GKE: app registry and bootstrap Application for gke-toolshed-prd-usc1

Adds the GCP counterpart of the homelab's cluster entry point, alongside
it rather than replacing it, so the two clusters never share a values
file:

- values/incubator-infra-gke-toolshed-prd-usc1-values.yaml, starting with
  only argocd, gitea and cert-manager. Every appSpec entry's nameOverride
  equals the Helm release name each is installed under by hand, which is
  what makes ArgoCD adopt those releases instead of rendering a second
  copy of each.
- incubator/incubator-infra-gke-toolshed-prd-usc1.yaml, the parent
  Application, applied once by hand.
- app-of-projects.yaml and the devops AppProject now point at this
  cluster's Gitea over cluster DNS, not the homelab's LAN hostname.

Sources are reached at gitea-http.gitea.svc.cluster.local:3000 rather
than through an Ingress: ArgoCD has to read them before Contour exists,
since Contour is itself one of the Applications it installs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N

values/incubator-infra-gke-toolshed-prd-usc1-values.yaml

@@ -0,0 +1,49 @@
+# GKE counterpart of incubator-infra-k8s-admin-prd-ase1-values.yaml. Starts
+# with only the three components installed by hand at bootstrap; every
+# other homelab component is added here as it is ported, each with its own
+# helm-overrides/gke-toolshed-prd-usc1/<name>/custom-values.yaml.
+clusterSpec:
+  destination:
+    server: ""
+    name: "in-cluster"
+
+argocdSpec:
+  namespace: argocd
+
+teamSpec:
+  devops:
+    source:
+      # Cluster DNS, not an Ingress: ArgoCD must be able to read this before
+      # Contour exists, because Contour is itself one of these Applications.
+      repoURL: http://gitea-http.gitea.svc.cluster.local:3000/gitadmin/devops-infra-helm-charts-gcp.git
+      targetRevision: main
+      path: helm-templates
+      valueFiles: ../../helm-overrides/gke-toolshed-prd-usc1
+    labels:
+      bu: infra
+      team: devops
+      env: prd
+      cluster: gke-toolshed-prd-usc1
+
+# nameOverride on every entry must equal the Helm release name used for the
+# manual bootstrap install. ArgoCD uses the Application name as the release
+# name, so a mismatch renders a second copy instead of adopting the first.
+appSpec:
+  - name: argocd
+    nameOverride: argocd-admin-prd
+    namespace: argocd
+    chartDir: argo-cd
+    valuesDir: argocd-admin-prd
+  - name: gitea
+    nameOverride: gitea
+    namespace: gitea
+    chartDir: gitea
+    valuesDir: gitea
+  - name: cert-manager
+    nameOverride: cert-manager
+    namespace: cert-manager
+    chartDir: cert-manager
+    valuesDir: cert-manager
+    # cert-manager's CRDs embed large OpenAPI schemas; SSA avoids the
+    # 256KiB last-applied-configuration limit, same as external-secrets.
+    serverSideApply: true