refactor(gitops): establish platform ownership boundaries

CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 2026-07-26
+
+- Clarified that this repository is an independent GitOps reference lab, not a
+  shared production platform or an application source monorepo.
+- Reclassified Kubernetes ownership as `platform`, `systems` and `workloads`;
+  moved the Project Auth PostgreSQL/Keycloak boundary to
+  `systems/auth-system`.
+- Replaced generic cluster `manifests` with ownership-aligned
+  `clusters/dev-k3s/overlays`.
+- Moved the Argo control-plane inventory to
+  `platform/control-plane/argocd` and separated permission-scoped AppProjects
+  for addons, shared services, systems and workloads.
+- Added a bootstrap-only `gitops-control-plane` AppProject so the root no
+  longer reconciles through Argo CD's unrestricted `default` project.
+- Replaced repeated child Application definitions with strict
+  list-generated ApplicationSets and explicit `autoSync` bootstrap gates.
+- Renamed the Project Auth backing-system namespace to `auth-system-dev` and
+  aligned service DNS, NetworkPolicy and ConfigMap ownership.
+- Changed Vault KV ownership from legacy `dev/platform` paths to
+  `dev/systems/auth-system` and `dev/workloads/auth-server` paths.
+- Split the broad `vault-core` ownership into `vault-foundation` and
+  `vault-workloads`, retaining `vault-database` as a third isolated state.
+- Documented delegated Terraform identities, stage-by-stage bootstrap and
+  non-destructive state/path migration procedures.
+- Kept GHCR as the image artifact boundary and made immutable digests the
+  promotion target; existing short commit tags remain until a registry-verified
+  promotion PR replaces them.
+- Performed repository-only refactoring and static validation; no Kubernetes,
+  Vault, Argo CD, registry or remote Terraform backend was mutated.
+
 ## 2026-07-25
 
 - Established the internal Gitea repository as the single GitOps source.