feat(gitops): self-managing root Kustomization (fixes F-OPS1)

The on-cluster cluster-vars ConfigMap wasn't reconciled by Flux — this bootstrap
model had no Kustomization watching clusters/dev, so cluster-vars/overlay changes
needed a manual 'kubectl apply -k clusters/dev' (e.g. DNS_ZONE substituted empty
until re-applied). Add clusters/dev/sync.yaml: a self-managing root Kustomization
(flux2 gotk-sync pattern, name flux-system) that reconciles ./clusters/dev from git
— cluster-vars, the GitRepository, platform/platform-config/apps, and itself. A git
push now suffices. Bootstrap unchanged ('kubectl apply -k clusters/dev' creates it
once). Verified: dev build contains all 6 objects (root + existing), prod unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

clusters/dev/kustomization.yaml

@@ -1,13 +1,15 @@
 ---
 # clusters/dev — the ACTIVE build target overlay.
 #
-# `flux bootstrap ... --path=clusters/dev` points the dev cluster's Flux here.
-# This overlay adds NO resources of its own. Its ONLY job is to patch the shared cluster-vars
-# ConfigMap with dev-scoped values (R-ENV-02). The base reconciliation graph is reused verbatim.
+# `flux bootstrap ... --path=clusters/dev` points the dev cluster's Flux here. It reuses the base
+# reconciliation graph and patches the shared cluster-vars ConfigMap with dev-scoped values (R-ENV-02).
+# It also adds a self-managing ROOT Kustomization (sync.yaml) so the whole graph reconciles from git
+# on every push — no more manual `kubectl apply -k` for cluster-vars/overlay changes (F-OPS1).
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+  - sync.yaml          # self-managing root Kustomization → ./clusters/dev
 patches:
   # --- SOPS decryption + bootstrap source (PM-inlined from bootstrap/flux/patches/, 2026-08-16) ---
   # Inlined (not cross-dir file refs) to stay within kustomize's default load restrictions.

clusters/dev/sync.yaml

@@ -0,0 +1,28 @@
+---
+# Self-managing ROOT Kustomization (the flux2 "gotk-sync" pattern).
+#
+# Reconciles ./clusters/dev from the GitRepository, so the ENTIRE graph is applied from git on every
+# push: the cluster-vars ConfigMap, the GitRepository source, the platform / platform-config / apps
+# Kustomizations — and THIS object itself. Without it the on-cluster cluster-vars ConfigMap was NOT
+# reconciled by Flux, so overlay / cluster-vars changes needed a manual `kubectl apply -k clusters/dev`
+# (DECISIONS-LOG F-OPS1). Now a `git push` is enough.
+#
+# Bootstrap is unchanged: `kubectl apply -k clusters/dev` (bootstrap/flux/bootstrap.sh step 3) still
+# creates this once; thereafter it self-reconciles. prune keeps the cluster matching git; wait:false
+# so the root never blocks on its children (platform has its own wait/health gating).
+# NOTE: env-specific (path ./clusters/dev). A prod overlay needs its own sync.yaml → ./clusters/prod.
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 10m
+  retryInterval: 2m
+  timeout: 5m
+  prune: true
+  wait: false
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./clusters/dev