Initial commit: GitOps Starter Pack

A teaching-first, single-cluster GitOps setup: Talos Linux + Argo CD with
an app-of-apps layout, MetalLB pre-installed for real LoadBalancer IPs on
bare metal, a demo app, and a progressive docs/ walkthrough with a
CLAUDE.md tutor persona and guided bootstrap checklist.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/demo.yaml

@@ -0,0 +1,52 @@
+# This is an Argo CD "Application" — not a Kubernetes-native concept, but a
+# Custom Resource that Argo CD adds to the cluster (see docs/glossary.md:
+# "CRD"). It tells Argo CD: "watch this path in this Git repo, and keep the
+# cluster's demo namespace matching whatever you find there."
+#
+# You never apply this file yourself. The app-of-apps
+# (argocd/app-of-apps/app-of-apps.yaml) watches this apps/ directory, and
+# Argo CD applies every Application it finds here automatically — including
+# this one. That's the whole "app-of-apps" trick: one Application manages a
+# folder of other Applications.
+#
+# --- Manifest-based vs. Helm-based apps ---
+# This app points at a plain folder of Kubernetes manifests (apps/demo/).
+# An app can instead point at a Helm chart — including an umbrella chart
+# whose Chart.yaml declares a `dependencies:` entry on a third-party chart
+# (e.g. a database or ingress controller from a public chart repo). Argo CD
+# detects a Helm chart automatically when it finds a Chart.yaml at the
+# source path, resolves its dependencies, and syncs the rendered output just
+# like any other app. See docs/07-adding-new-apps.md for a worked example —
+# the demo app deliberately stays plain manifests so the GitOps loop is easy
+# to read end to end with no templating in the way.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: demo
+  namespace: argocd
+spec:
+  project: default
+
+  source:
+    repoURL: https://github.com/YOUR_GITHUB_USERNAME/k8s-starter-pack.git
+    targetRevision: main
+    path: apps/demo
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: demo
+
+  syncPolicy:
+    automated:
+      # prune: delete cluster objects whose manifest was removed from Git.
+      # selfHeal: if someone changes the cluster by hand (e.g. `kubectl edit`),
+      # Argo CD reverts it back to match Git on the next reconciliation pass.
+      # Together these are what make Git the actual source of truth instead
+      # of just a suggestion.
+      prune: true
+      selfHeal: true
+    syncOptions:
+      # Creates the `demo` namespace automatically if it's missing, instead
+      # of failing sync. We also declare it explicitly in namespace.yaml for
+      # visibility, so this is a safety net more than a requirement here.
+      - CreateNamespace=true