Add jenkins-ci scoped ArgoCD account and RBAC to argocd custom-values

Adds accounts.jenkins-ci (apiKey) and a repo-scoped RBAC policy
(sync/get on default/demo-go-app only) so devops-lib's syncArgoApp
stage can trigger syncs without full admin access.

helm-overrides/k8s-admin-prd-ase1/argocd-admin-prd/custom-values.yaml

@@ -91,10 +91,26 @@ argo-cd:
         hs.status = "Healthy"
         hs.message = "Ingress considered healthy on sight — this cluster's Contour has no LoadBalancer status to wait on (hostPort, not MetalLB)."
         return hs
-    # No custom RBAC policy: single-user homelab, the initial admin secret
+      # Scoped account for Jenkins to trigger a sync as the last step of the
-    # (kubectl -n argocd get secret argocd-initial-admin-secret) is enough.
+      # CI/CD pipeline — devops-lib's real deployArgoCD.groovy always closes
-    # The fleet's role:admins / role:backend / GitHub-team policy.csv and
+      # its 4-step ceremony with `argocd app sync --hard-refresh`; without
-    # real teammate emails from the source cluster are dropped here.
+      # this, our pipeline stops at the tag-bump commit and a human has to
+      # remember to click Sync. Uses apiKey auth (token-based), not the
+      # admin account — same least-privilege pattern as Harbor's robot
+      # account. Token itself is generated via CLI (not declarative — see
+      # bootstrap note in devops-lib's syncArgoApp.groovy) and stored in
+      # Vault like every other credential here.
+      accounts.jenkins-ci: apiKey
+      accounts.jenkins-ci.enabled: "true"
+    # No custom RBAC policy beyond the jenkins-ci account below: single-user
+    # homelab, the initial admin secret (kubectl -n argocd get secret
+    # argocd-initial-admin-secret) is enough for you. The fleet's
+    # role:admins / role:backend / GitHub-team policy.csv and real teammate
+    # emails from the source cluster are dropped here.
+    rbac:
+      policy.csv: |
+        p, jenkins-ci, applications, sync, default/demo-go-app, allow
+        p, jenkins-ci, applications, get, default/demo-go-app, allow
     repositories:
       devops-infra-helm-charts:
         url: http://gitea.192.168.1.7.nip.io/mukul/devops-infra-helm-charts.git