Everything-is-an-app cutover: standalone apps + delete env/apps + secrets audit

Nobody has claimed this yet.

## Parent

linode/apl-core#3515

> **Design update (supersedes original §3/§8):** enable flags live in `AplCluster.spec.apps` (`env/settings/cluster.yaml`), and the `AplApp` kind is removed. Gating still resolves from `.Values.apps..enabled` via the `derived.gotmpl` overlay-then-unset. See linode/apl-core#3515 comment and ADR `adr/2026-08-21-app-enable-flags-in-aplcluster.md`.

## What to build

Cut the **remaining "standalone" core apps** over to the new git-driven layout and finish the structural cutover. These apps share **no** cross-cutting managed setting beyond the universal four (`useORCS`, `nodeSelector`, `version`, `globalPullSecret`), so their `values.managed.yaml` carries only those universal injections.

Apps in this batch (all remaining core releases not covered by earlier batches), e.g.:
`metrics-server`, `kyverno`, `policy-reporter`, `sealed-secrets`, `external-secrets`, `cnpg` (+ barman plugin), `linode-cfw`, `trivy`, `knative`, `kserve`, `rabbitmq`, `tekton`, `git-server`, `apl-operator`, `apl-harbor-operator`, `apl-gitea-operator`, `apl-keycloak-operator`, `otomi-operator`, `otomi-api`, and any others still on the legacy path.

This batch also completes the cutover:
- Delete `env/apps/` entirely once all apps are migrated, and remove the `AplApp` kind + its file-map entry (enablement now lives in `AplCluster.spec.apps`).
- Remove the legacy inline-values ArgoCD path and any now-dead per-app `values//.gotmpl` translation files (keeping `-raw.gotmpl` files).
- Run the secrets audit: enumerate charts that only accept an inline secret (no `existingSecret`) and record them as a follow-up risk list; ensure all migrated value files are secret-free.

## Acceptance criteria

- [ ] Every remaining core app reconciles Healthy in ArgoCD from its `env/values///{managed,custom}.yaml`.
- [ ] `env/apps/` is deleted and the `AplApp` kind + file-map entry removed; no app reads from `env/apps/`.
- [ ] Legacy inline-values path and dead per-app `.gotmpl` translation files removed; `-raw.gotmpl` files retained.
- [ ] Secrets audit completed: inline-secret-only charts enumerated; all value files verified secret-free.
- [ ] Existing `installed:` gating still works from `AplCluster.spec.apps` (`env/settings/cluster.yaml`) for all apps.

## Blocked by

- linode/apl-core#3571
- linode/apl-core#3572
- linode/apl-core#3573

Read the parent issue and ADR `adr/2026-08-21-app-enable-flags-in-aplcluster.md`, then inspect `env/values///{managed,custom}.yaml`, `env/apps/`, and `env/settings/cluster.yaml`. Done means remaining apps reconcile Healthy in ArgoCD, legacy paths and dead translations are removed, `AplApp` is gone, enablement still works, and the secrets audit is recorded with value files secret-free.

Written by the indexing model from the issue text.