feat: add kubeadm bootstrap, Argo CD root app and lab RBAC

Terraform 설계서 7.2·7.3의 WP-07 내용.

- bootstrap/kubeadm/init-cp.sh: kubeadm init(사설 IP advertise, EIP cert SAN,
  pod CIDR 10.244.0.0/16) → flannel v0.28.9 → Argo CD v3.5.3(server-side apply)
  → root-app 적용 → 워커 join 명령을 /opt/selfheal/join.sh(0600)에 저장. 재실행 안전.
- bootstrap/kubeadm/join-worker.sh: join 명령을 stdin으로 받아 실행(토큰이 터미널·로그에
  남지 않음). 이미 join된 노드는 0으로 종료.
- argocd/root-app.yaml: apps/ 재귀 app-of-apps(공개 저장소, 자격증명 불요).
- apps/rbac.yaml + workloads/rbac: 네임스페이스 chaos-mesh·demo, SA harness(ClusterRole
  selfheal-harness: chaos-mesh.org/*, deployments·scale, pods, nodes patch, pods/eviction),
  SA ai-reader(ClusterRole view).

workloads/rbac/harness.yaml

@@ -0,0 +1,41 @@
+# harness runner identity (Terraform design 6.11): Chaos Mesh CRs, rollout/scale, pod reads, cordon/drain.
+# Tokens are minted by `make token` (kubectl create token harness -n chaos-mesh --duration 24h) into Secret Manager.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: harness
+  namespace: chaos-mesh
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: selfheal-harness
+rules:
+  - apiGroups: ["chaos-mesh.org"]
+    resources: ["*"]
+    verbs: ["*"]
+  - apiGroups: ["apps"]
+    resources: ["deployments", "deployments/scale"]
+    verbs: ["get", "list", "watch", "patch"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list", "watch", "patch"]
+  - apiGroups: [""]
+    resources: ["pods/eviction"]
+    verbs: ["create"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: selfheal-harness
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: selfheal-harness
+subjects:
+  - kind: ServiceAccount
+    name: harness
+    namespace: chaos-mesh