docs: mark Renovate Argo CD tag tracking as done

[AHS0003]

What

The "Open hardening TODOs" section in docs/rbac-layers.md lists Renovate
tracking of the upstream Argo CD tag as outstanding, under Operability:

Renovate (or equivalent) for the upstream Argo tag in
patches/kustomization.yaml so the sed-at-install dance in the README
becomes obsolete.

Why this is stale

This is already implemented. renovate.json5 has a customManagers regex
entry that tracks exactly this file:

{
  customType: 'regex',
  description: 'Argo CD upstream version in the kustomize remote base URL',
  managerFilePatterns: ['/^argo-setup/patches/kustomization\\.yaml$/'],
  matchStrings: ['raw\\.githubusercontent\\.com/argoproj/argo-cd/(?<currentValue>v[\\d.]+)/manifests/'],
  depNameTemplate: 'argoproj/argo-cd',
  datasourceTemplate: 'github-releases',
},

It matches the pinned tag in argo-setup/patches/kustomization.yaml
(raw.githubusercontent.com/argoproj/argo-cd/v3.3.11/manifests/ha/install.yaml)
and opens the bump PR automatically. The item just above it in the same doc
(CI diff check for upstream ClusterRoles) was marked done when it landed;
this one wasn't updated to match.

Change

Updates the TODO entry to reflect that it's done, and points to
renovate.json5 and the Bumping Argo CD procedure in
argo-setup/README.md for the manual review step (ClusterRole diff
reconciliation) that still applies after Renovate opens the bump PR.

Testing

Docs-only change no code, manifests, or CI affected. Verified the
regex in renovate.json5 against the live line in
argo-setup/patches/kustomization.yaml and confirmed it matches.

[Copilot]

Copilot review overview

🟢 Approval recommended

Documentation-only update with no unresolved review issues.

Review effort: Lite
Findings: None

What changed in this PR

Updates RBAC documentation to mark Argo CD Renovate tag tracking as complete.

Changes:

• References the Renovate configuration and upgrade procedure.
• Retains manual ClusterRole reconciliation guidance.

File	Description
docs/​rbac-layers.md	Marks Argo CD Renovate tracking as completed and documents the remaining review step.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.