Fix syncArgoApp checking the wrong ARGOCD_TOKEN entirely

Build #14/#15 kept failing "ARGOCD_TOKEN is empty" even after
confirming the actual Kubernetes Secret has a real token value. Root
cause: the check used Groovy's env.ARGOCD_TOKEN, which is Jenkins'
own pipeline-level environment map — populated from build parameters,
environment{} blocks, withEnv, etc. — not the container's actual OS
environment. A container-scoped env: entry in a podTemplate YAML
(dind-pod.yaml's secretKeyRef) never populates that Groovy map; it
only sets the real process environment inside that container, which
sh steps correctly inherit. So this check was always going to see
null regardless of how correctly Vault/ESO/the Secret were wired —
every fix to that chain was chasing the wrong problem. Moves the
emptiness check into the shell script itself, where $ARGOCD_TOKEN
genuinely resolves.

src/com/homelab/stages/syncArgoApp.groovy

@@ -16,17 +16,29 @@ package com.homelab.stages
 // empty (bootstrap token not generated yet), fail loudly here with a
 // clear message rather than a confusing curl auth error.
 //
+// The emptiness check has to happen inside the shell script, not as a
+// Groovy `env.ARGOCD_TOKEN` check before it — env.X in Groovy is
+// Jenkins' own pipeline-level environment map (build parameters,
+// environment{} blocks, withEnv, etc.), which a container-scoped env:
+// entry in a podTemplate YAML never populates. The container's real OS
+// environment does have it (visible to sh, which inherits the
+// container's actual process environment) — checking env.ARGOCD_TOKEN
+// in Groovy was always going to see null regardless of whether the
+// Secret/ESO/Vault chain was correctly wired, which is exactly what
+// happened: every fix to the secret chain made no difference because
+// the check itself was looking in the wrong place.
+//
 // Expects in config:
 //   argo_app_name    the Application's metadata.name, e.g. demo-go-app
 //   argo_server_url  e.g. http://argocd-admin-prd-server.argocd.svc.cluster.local
 def run(Map config) {
     stage(stageName('Sync ArgoCD Application')) {
         container('docker-cli') {
-            if (!env.ARGOCD_TOKEN?.trim()) {
-                log.error('ARGOCD_TOKEN is empty — the jenkins-ci account token has not been generated yet. See secretstores/argocd-jenkins-ci-token.yaml for the one-time bootstrap steps.')
-                error('Skipping ArgoCD sync: no token available.')
-            }
             sh """
+                if [ -z "\$ARGOCD_TOKEN" ]; then
+                    echo "ARGOCD_TOKEN is empty — the jenkins-ci account token has not been generated yet. See secretstores/argocd-jenkins-ci-token.yaml for the one-time bootstrap steps." >&2
+                    exit 1
+                fi
                 apk add --no-cache curl >/dev/null
                 curl -sf -X POST \\
                   -H "Authorization: Bearer \$ARGOCD_TOKEN" \\