feat(system+ci): add Istio/Argo CD system stack and CI

[rowan-stein]

Implements the system stack (Istio + Argo CD) using Terraform (helm + kubernetes providers) with local backend state, and adds CI to terraform apply stacks/k8s then stacks/system in one job on PRs and main.

• stacks/system: namespaces, Helm repos, Helm releases (istio-base, istiod, gateway, argo-cd) with pinned versions and minimal values.
• CI: .github/workflows/bootstrap.yml to provision k3d and apply both stacks; PR runs include teardown.
• Defaults require no manual variable setting; system stack uses conventional kubeconfig path from k8s stack.

[noa-lucent]

Thanks for the stack+CI work. I spotted a few blockers we need to sort out before this can merge.

[casey-brooks]

Local Validation

• terraform fmt -recursive
• terraform -chdir=stacks/k8s validate
• terraform -chdir=stacks/k8s plan (add=2, change=0, destroy=0)
• TF_VAR_kubeconfig_path=../k8s/.kube/agyn-local-kubeconfig.yaml terraform -chdir=stacks/system validate
• TF_VAR_kubeconfig_path=../k8s/.kube/agyn-local-kubeconfig.yaml terraform -chdir=stacks/system plan (add=7, change=0, destroy=0)

All commands completed successfully.

[noa-lucent]

Everything looks good now—thanks for addressing the provider wiring and CI teardown strictly.

[vitramir]

Can we make this default value? So if we apply all stacks one by one without customization there is no need to provide values manually?

[rowan-stein]

Acknowledged. We’ll remove the TF_VAR override and rely on the system stack’s default kubeconfig_path so no manual values are needed during sequential applies. Casey will push the CI update shortly.

[casey-brooks]

Dropped the TF_VAR_kubeconfig_path env override from the CI workflow so the system stack now uses its default value. Verified via terraform plan that both stacks run cleanly without setting variables manually.

[casey-brooks]

Local Validation

• terraform fmt -recursive
• terraform -chdir=stacks/k8s init
• terraform -chdir=stacks/k8s validate
• terraform -chdir=stacks/k8s plan (add=2, change=0, destroy=0)
• terraform -chdir=stacks/system init
• terraform -chdir=stacks/system validate
• terraform -chdir=stacks/system plan (add=7, change=0, destroy=0)

Plans run with the system stack's default kubeconfig_path to confirm no manual variable input is required.

[casey-brooks]

Follow-up for the admin credential seeding is tracked in #5 since this PR was already merged. That change configures the Argo CD Helm chart to ship with the admin:admin bcrypt hash by default.