Initial commit: GitOps Starter Pack

A teaching-first, single-cluster GitOps setup: Talos Linux + Argo CD with
an app-of-apps layout, MetalLB pre-installed for real LoadBalancer IPs on
bare metal, a demo app, and a progressive docs/ walkthrough with a
CLAUDE.md tutor persona and guided bootstrap checklist.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

argocd/app-of-apps/app-of-apps.yaml

@@ -0,0 +1,47 @@
+# The app-of-apps. This is the ONE manifest in this entire repo that you
+# apply by hand, one time, with `kubectl apply -f`. It's the seed: after
+# this exists, Argo CD takes over and everything else in the apps/ folder
+# gets applied automatically, because this Application's job is to watch
+# that folder.
+#
+# Before applying this file, edit spec.source.repoURL below to point at YOUR
+# fork of this repo (Argo CD needs to clone it, so it must be a real URL it
+# can reach — not this template's URL).
+#
+# >> Ask Claude: "why does the app-of-apps live in argocd/app-of-apps
+#    instead of inside apps/ with everything else?" before moving on — the
+#    answer (avoiding a directory managing itself) is worth understanding.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: app-of-apps
+  namespace: argocd
+spec:
+  project: default
+
+  source:
+    repoURL: https://github.com/YOUR_GITHUB_USERNAME/k8s-starter-pack.git
+    targetRevision: main
+    path: apps
+    directory:
+      # recurse: false is deliberate. apps/ contains both Application
+      # manifests (apps/demo.yaml) AND subfolders full of the actual
+      # workload manifests they point to (apps/demo/*.yaml). Without this,
+      # Argo CD would try to apply everything inside apps/demo/ directly
+      # under the app-of-apps too — duplicating work the demo Application
+      # already does, and blurring which Application actually owns what.
+      # recurse: false means "only look at files directly in apps/, ignore
+      # subfolders" — so the app-of-apps only ever sees the Application
+      # manifests, never the workloads themselves.
+      recurse: false
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true