demo-go-app moved from ArgoCD's default project to the new webapp project (devops-argo-config#7de2f8b). ArgoCD RBAC is keyed <project>/<app-name>, so the jenkins-ci sync/get policy has to move with it or syncArgoApp's scoped token starts getting silent 403s on its next sync.