Seal remaining Gitea secrets: API token, runner token, pull secret

All placeholder secrets replaced with real sealed values:
- argocd-gitea-token: API token for ArgoCD PR generator
- gitea-runner-token: registration token for in-cluster runner
- gitea-pull-secret: registry credentials for app image pulls

infra/kubernetes/argocd/argocd-gitea-token-sealed.yaml

@@ -1,5 +1,3 @@
-# PLACEHOLDER: Re-seal with Gitea API token for PR generator
-# ./scripts/seal-secret.sh argocd-gitea-token argocd token=<gitea-api-token>
 ---
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
@@ -8,7 +6,7 @@ metadata:
   namespace: argocd
 spec:
   encryptedData:
-    token: PLACEHOLDER_SEAL_ME
+    token: AgAAkJ90zxscN8Oe1ImwFvdYFfEYAxjkCyuf9g1aGvYRByq9ctQqC8JB9OiECK14Cof6S5iJMi3cH4+BV4X5gNrOipfFyvmQHMs0aEKwi/darwP0aHq2VOMAPK2GsLrtNYbhChbzTfuB5hlfCr/AVLWHrA3q8qArejcrw9UEeatWlCrzzugww8ROlMa1ozNIqGHFiqdYQDSuD0SlJ4V5m3W/6Y88zfjZzB7KvjTYsU81Hf06m3fZ04sGxuiuTfy+JxfQrKjRubJGyi2QEK534XXf/wy2Cs5c8+TaCVlxzAPNjeHAku8GsXRnHfdLXSjQSSpe7WeqtKJJ8AHFNXZQIngBD3tdYxA8NoYMgFE0vUS5RTgT7CL84wi5gpK+at7kwNmRJHMw22b2qPl/tMsohtEmjr/DiFJob5coB4c3RLVlmhvdf3jASc77RKoPE2REt+2D8Lsj7VUW+ZDQBSHOSgGqu593tRj0bu3bFkd+/3bI8O6XS0E5GtTbXYqpN1mDGVdi8n5ncd5AQmkQ2Wf0dKgh1Za1qtH3Vo/ELUiRfBZufsHzgEpKxM0jcW4tnS3/1MDJmB3KW2v6kCPDpRH82FTvGtqt3YaQ7+IB1wyQj0SkMkG/mQf1oi0Oo8i4T59HboDtdyqfaMI949CQcYsrnXPFOhHbUAlA87tB+9TiDD87yauP0MCyhTSQjNJJIqjxl58PEkTA4KZioCIq5iBDHtMUZ4bcP8OS+Y8UUIZtZ6HgNUHXkgr6IQ+7
   template:
     metadata:
       name: argocd-gitea-token