gitops-update: support per-cluster env suffix variants (-st / -mt) for benedita #422

Problem

The current gitops-update.yml reusable workflow and the config/deployment-matrix.yml schema assume each Kubernetes cluster runs one variant per environment (dev, stg, prd, sandbox). This assumption is hardcoded in:

• The tag-type → environment mapping (gitops-update.yml lines 429-444): a production tag always produces dev stg prd sandbox, with no way to express a "suffixed" variant.
• The helmfile values path (line 590): gitops/environments/{server}/helmfile/applications/{env}/{app}/values.yaml, where {env} is one of those four hardcoded values.
• The ArgoCD app name template default ({server}-{app}-{env}): produces benedita-midaz-dev, not benedita-midaz-dev-st.

Impact

The new Benedita cluster hosts two parallel variants per environment:

• Single-tenant (-st): dev-st, stg-st, prd-st
• Multi-tenant (-mt): dev-mt, stg-mt, prd-mt

These exist as sibling Kubernetes namespaces, helmfile directories (environments/benedita/helmfile/applications/dev-st/...), and ArgoCD applications (benedita-midaz-dev-st). The sandbox environment is shared across variants and stays bare (no suffix).

Currently, an app repo (e.g. LerianStudio/midaz) cutting a beta tag and calling this workflow with gitops_repository: LerianStudio/midaz-firmino-gitops:

• Updates dev/midaz/values.yaml → does not exist on benedita → workflow logs WARNING: Values file not found and skips
• Tries to sync benedita-midaz-dev → does not exist → argocd app get fails and sync is silently skipped (line 819-820)
• Net result: benedita is not updated by app releases, and there is no error surfaced to the caller

This blocks promotion of the standard CI/CD release flow to the -st/-mt clusters and forces manual gitops PRs.

Proposed solution

Extend the cluster block in config/deployment-matrix.yml with two additive, backward-compatible fields:

clusters:
  benedita:
    env_suffixes: ["-st", "-mt"]         # produces dev-st, dev-mt, stg-st, ...
    suffix_excludes_envs: ["sandbox"]    # sandbox stays bare (no -st/-mt)
    apps: [...]

Defaults:

• env_suffixes: [""] (empty suffix) when absent → firmino/clotilde/anacleto behavior is unchanged
• suffix_excludes_envs: [] when absent → no effect

Workflow change (gitops-update.yml):

• After the existing tag-type → env mapping, per cluster: expand each env not in suffix_excludes_envs against env_suffixes to produce the final env list
• All downstream logic (helmfile path resolution, ArgoCD app name resolution via {env} placeholder, sync matrix) already works once $ENV carries the full suffixed name (e.g. dev-st)
• Cross apps (those with app_helmfile_env already set, e.g. rosiehr, forge) continue to bypass suffix expansion — they update once at their override path

Out of scope for this PR:

• Per-app suffix restriction (e.g. "tenant-manager is MT-only") — to be added as app_env_suffixes in a follow-up when an actual MT-only or ST-only app emerges
• Renaming non-standard ArgoCD app names (benedita-forge, benedita-cs-platform, benedita-lerian-map → *-cross) — handled separately by the gitops repo

Acceptance criteria

• A production tag from any app repo, with the manifest declaring env_suffixes: ["-st", "-mt"] on benedita and suffix_excludes_envs: ["sandbox"], updates exactly: dev-st, dev-mt, stg-st, stg-mt, prd-st, prd-mt, sandbox on benedita.
• Firmino, clotilde, anacleto behavior is byte-identical to today (no manifest change, no workflow change in their resolved env list).
• ArgoCD app name resolution produces benedita-midaz-dev-st (etc.) without changes to the argocd_app_name_template input.
• Docs (docs/gitops-update-workflow.md) describe the new fields with an example.