Initial commit: GitOps Starter Pack

A teaching-first, single-cluster GitOps setup: Talos Linux + Argo CD with
an app-of-apps layout, MetalLB pre-installed for real LoadBalancer IPs on
bare metal, a demo app, and a progressive docs/ walkthrough with a
CLAUDE.md tutor persona and guided bootstrap checklist.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/metallb.yaml

@@ -0,0 +1,41 @@
+# MetalLB, installed like any other app: an Application pointing at
+# apps/metallb, a Helm chart (see apps/metallb/Chart.yaml) that both pulls
+# in the upstream MetalLB chart AND carries our own IPAddressPool and
+# L2Advertisement as extra templates (apps/metallb/templates/). Once this
+# syncs, the cluster can hand out real IP addresses to Services of type
+# LoadBalancer — something bare-metal Kubernetes doesn't do on its own
+# (that's normally a cloud provider's job). See docs/05-metallb.md for the
+# full explanation and the setup questions you'll need to answer before
+# this is actually useful.
+#
+# Everything — MetalLB's own resources (including its CRDs) and our two
+# custom resources that depend on them — comes from this one Application,
+# in one sync. The ordering that makes that safe lives on the individual
+# resources in apps/metallb/templates/, via the
+# argocd.argoproj.io/sync-wave annotation: MetalLB's chart resources apply
+# at the default wave ("0"), and our IPAddressPool/L2Advertisement are
+# marked wave "1" so Argo CD waits for MetalLB to be synced and healthy
+# (CRDs registered, controller and speaker running) before applying them.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: metallb
+  namespace: argocd
+spec:
+  project: default
+
+  source:
+    repoURL: https://github.com/YOUR_GITHUB_USERNAME/k8s-starter-pack.git
+    targetRevision: main
+    path: apps/metallb
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: metallb-system
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true