Argo Refs code-dot-org Commit

Short name: Argo refs commit

Catchy description: Write one tiny release record to warehouses/codeai/,
then let Argo CD deploy Helm source pinned to a code-dot-org
commit.

Detailed Technical Description of Plan

This plan is the simplest source-driven Kargo design in iteration 7. Kargo does
not snapshot a release package or render review output into Freight; instead it
promotes a tiny Git build-lock record from k8s-gitops that names one exact
code-dot-org commit and one exact image tag/digest. The build-lock is the
release record, and current.yaml is just a stable parse path to that same
record. The whole point is to keep Freight small, deterministic, and easy to
audit while still letting the real deploy source live in code-dot-org.

In the Helm variant, Argo points directly at code-dot-org
k8s/helm at the pinned commit and uses k8s-gitops only for env values and
deployment metadata. The build-lock file and the deployment refs must stay in
sync, the GH action must keep the image tag and the lock file in sync, and
Kargo confirms packaging.kind: helm and sourcePath: k8s/helm before it
mutates GitOps.

• Type: Source-driven plan family
• Pattern: Source-driven
• Rendered manifests pattern: No

argo-refs-code-dot-org-commit

Sibling PR: code-dot-org/k8s-gitops#1