Upgrade Argo CD to chart 10.8.4 (v3.5.2)

Removes the cause of the diff failures that ServerSideDiff worked around:
v2.13.8 diffs against a Kubernetes schema compiled into its own binary,
and this cluster is newer than that schema.

Three things needed real changes, none of them mechanical:

- applicationSet.enabled no longer exists, and there is no replacement
  gate — unlike dex and notifications, the ApplicationSet controller's
  Deployment carries no conditional at all. Helm ignores unknown keys, so
  carrying the old value forward would have quietly started a controller
  nothing here uses. replicas: 0 is the only lever.

- The image tag pin is dropped rather than moved to v3.5.2. The chart's
  appVersion governs, so image and chart cannot drift; a pin outliving its
  chart is close to the failure being fixed here.

- server.insecure moved from server.extraArgs to configs.params, which is
  what the chart renders into argocd-cmd-params-cm. Caught by rendering:
  an earlier version of this commit deleted the extra arg on the strength
  of a comment claiming configs.params already set it, which it did not —
  Argo CD would have served its own TLS behind Contour and produced a
  redirect loop.

Verified in the rendered output: image v3.5.2 and no v2.13.8 anywhere,
server.insecure true, dex and notifications absent, ApplicationSet at zero
replicas, both HPAs intact with replicas omitted, ingress on Contour, repo
Secrets on cluster DNS.

Behaviour changes in v3 that apply here, none needing a values change:
logs RBAC is now enforced (jenkins-ci only syncs), update/delete no longer
inherit to sub-resources, and resource tracking moves from labels to
annotations, so the first sync re-stamps every managed resource.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N

helm-templates/argo-cd/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: argo-cd
   repository: https://argoproj.github.io/argo-helm
-  version: 7.7.23
-digest: sha256:5d5bb5374bd6a589b5a070a2e48bb1dd211e3871c31af9700297575c84e6f70e
-generated: "2026-08-31T06:40:31.347755+05:30"
+  version: 10.8.4
+digest: sha256:bf31d2cce073a775bf05ec90b74ae45625df5fb6774323a9139d4f8a1be2440a
+generated: "2026-09-12T15:22:56.688354+05:30"

helm-templates/argo-cd/Chart.yaml

@@ -3,5 +3,14 @@ name: argocd
 version: 1.0.0
 dependencies:
   - name: argo-cd
-    version: 7.7.23
+    # Argo CD v3.5.2. Bumped from 7.7.23 (v2.13.8), which was older than
+    # this cluster: it diffs against a Kubernetes schema compiled into its
+    # own binary, and GKE 1.35 has fields that schema predates
+    # (status.terminatingReplicas, beta since 1.33), which aborted the diff
+    # on every server-side-apply app. ServerSideDiff works around that; this
+    # removes the cause.
+    #
+    # Not a drop-in: see the 2.x -> 3.0 notes in this cluster's
+    # argocd-admin-prd/custom-values.yaml for what changed in behaviour.
+    version: 10.8.4
     repository: https://argoproj.github.io/argo-helm