Initial commit: GitOps Starter Pack

A teaching-first, single-cluster GitOps setup: Talos Linux + Argo CD with
an app-of-apps layout, MetalLB pre-installed for real LoadBalancer IPs on
bare metal, a demo app, and a progressive docs/ walkthrough with a
CLAUDE.md tutor persona and guided bootstrap checklist.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/03-installing-argocd.md

@@ -0,0 +1,58 @@
+# 03 — Installing Argo CD
+
+Your cluster is alive but empty — it can run containers, but nothing is
+telling it to run anything yet. This doc installs Argo CD, the piece that
+watches Git and does that telling from now on.
+
+## Why this one step is imperative
+
+Everything else in this repo — every app, every future addition — gets
+deployed *by* Argo CD, driven from Git. Argo CD itself is the one exception:
+something has to exist in the cluster *before* it can start reading Git, so
+installing it can't itself be a GitOps-managed step. This is normal, and
+every GitOps setup has some version of this same bootstrap moment. We
+install it the straightforward way the Argo CD project documents — one
+`kubectl apply` of their maintained manifest bundle — rather than adding an
+extra tool (Helm, an operator) just to install the GitOps tool itself.
+
+## What you're installing
+
+Argo CD is itself a set of things running inside your cluster: an API
+server, a piece that watches Git repos, a piece that computes diffs against
+the live cluster, and a UI. You're about to install all of it with one
+command, into its own `argocd` namespace, so it stays cleanly separated
+from the apps it will go on to manage.
+
+## Steps
+
+Exact commands: [`argocd/README.md`](../argocd/README.md). Summary of what
+each stage does:
+
+1. **Install.** `kubectl apply` the official manifest bundle into a new
+   `argocd` namespace. This creates Argo CD's own pods *and* a handful of
+   CRDs (see [`docs/glossary.md`](glossary.md)) — the most important being
+   `Application`, the resource type you'll use for every app from here on,
+   including the demo app and the app-of-apps.
+
+2. **Get the initial admin password.** Auto-generated on first install and
+   stored as a Kubernetes Secret.
+
+3. **Reach it.** Port-forward the Argo CD UI/API to your local machine and
+   log in with the `argocd` CLI (and optionally, a browser).
+
+4. **Apply the app-of-apps.** This is the moment the GitOps loop actually
+   starts — see [`docs/04-app-of-apps.md`](04-app-of-apps.md) next.
+
+> **Ask Claude:** "why is a port-forward good enough for now, and what
+> would I need instead to reach this Argo CD from somewhere other than my
+> own machine?" — a preview of the Ingress topic in
+> [`docs/08-growing-up.md`](08-growing-up.md).
+
+## Checklist
+
+- [ ] Argo CD pods all `Running`/`Ready` in the `argocd` namespace
+- [ ] Initial admin password retrieved
+- [ ] Logged in via `argocd login` (CLI) and/or the UI in a browser
+
+Once you're logged in, continue to
+[`docs/04-app-of-apps.md`](04-app-of-apps.md).