Argo: explicit cluster resource whitelist for webhooks; Temporal multi-source valueFiles ref=values

Co-authored-by: Cursor <cursoragent@cursor.com>

platform/bootstrap/apps/app-temporal.yaml

@@ -16,10 +16,10 @@ spec:
       targetRevision: 0.55.0
       helm:
         valueFiles:
-          - $repo/helm-values.yaml
+          - $values/helm-values.yaml
     - repoURL: http://192.168.8.248:3000/deepkoluguri/agentic-os.git
       targetRevision: main
-      ref: repo
+      ref: values
       path: ai-core/temporal
   syncPolicy:
     automated:

platform/bootstrap/root-app-project.yaml

@@ -13,8 +13,19 @@ spec:
     - namespace: "*"
       server: https://kubernetes.default.svc
   clusterResourceWhitelist:
+    # Broad allow; some Argo CD builds still reject certain cluster kinds unless named explicitly.
     - group: "*"
       kind: "*"
+    - group: admissionregistration.k8s.io
+      kind: MutatingWebhookConfiguration
+    - group: admissionregistration.k8s.io
+      kind: ValidatingWebhookConfiguration
+    - group: apiextensions.k8s.io
+      kind: CustomResourceDefinition
+    - group: rbac.authorization.k8s.io
+      kind: ClusterRole
+    - group: rbac.authorization.k8s.io
+      kind: ClusterRoleBinding
   namespaceResourceWhitelist:
     - group: "*"
       kind: "*"