chore: scaffold gitops repository layout

Terraform 설계서 2장의 디렉터리 구조대로 뼈대만 만든다. 각 디렉터리의 내용은
해당 WP(07·08~12·14·15)에서 채운다. VM 디렉터리 이름은 Terraform이 VM
메타데이터로 넘기는 role 값(postgres-primary/-replica 포함)과 일치시킨다.
저장소는 공개이며 시크릿은 두지 않는다(값은 Secret Manager).

README.md

@@ -0,0 +1,24 @@
+# selfheal-lab-gitops
+
+GitOps and configuration repository for the self-healing verification lab
+(VM + container mixed environment). Infrastructure lives in
+`seon-labs/selfheal-lab-terraform`; this repository holds everything that runs
+on top of it.
+
+This repository is **public on purpose**: every EC2 node and GCE VM clones it
+anonymously at first boot (cloud-init / startup script), and MIG instances are
+recreated by autohealing without an operator. Never commit secrets here; values
+live in GCP Secret Manager and are fetched at runtime.
+
+| Path | Owner | Filled in |
+|---|---|---|
+| `bootstrap/kubeadm/` | operator, run once | WP-07: containerd/kubeadm init+join, flannel, Argo CD install, root-app |
+| `argocd/root-app.yaml` | Argo CD app-of-apps root | WP-07 |
+| `apps/` | child Argo CD Applications | WP-14 |
+| `workloads/{demo-app,ingress-nginx,chaos-mesh,alloy}/` | Argo CD | WP-14, WP-15 |
+| `vm/<role>/apply.sh` | GCE startup script and `make vm-sync` | WP-08..12 |
+
+`vm/<role>` matches the `role` metadata each VM gets from Terraform:
+`observability`, `harness`, `ai-env`, `postgres-primary`, `postgres-replica`,
+`legacy-api`. The startup script runs `vm/<role>/apply.sh` when it exists and is
+executable; `apply.sh` must be idempotent because `make vm-sync` re-runs it.