Docs and ArgoCD examples don't work on a NIC cluster: project: default, unlabeled namespace, no repo credentials #35

The deployment docs leave out three things a NIC-built cluster requires, and every ArgoCD Application example in the repo would fail there.

Project

NIC creates three AppProjects (pkg/argocd/project.go:176-230). default is deny-all (sourceRepos: [], destinations: []), and packs belong in nebari-apps. NIC's own docs/operations/argocd-project-scoping.md:11-16 says so. Every Application example here uses project: default: README.md:617, README.md:649, README.md:675, and the Application in each example README (basic-nginx, kustomize-nginx, vanilla-yaml, wrap-existing-chart, auth-fastapi).

Namespace opt-in

The operator only reconciles NebariApps in namespaces labeled nebari.dev/managed=true. The examples use CreateNamespace=true with no managedNamespaceMetadata, and no example ships a labeled Namespace, so ArgoCD creates an unlabeled namespace and the NebariApp sits at NamespaceNotOptedIn. NIC labels its own app namespaces through syncPolicy.managedNamespaceMetadata (pkg/argocd/templates/apps/opentelemetry-collector.yaml:35-44). The docs only show a manual kubectl label (docs/site/src/content/docs/nebariapp-crd-reference.md:239-248).

Private repos

docs/site/src/content/docs/build-your-own.md:45-47 says a private pack "works the same as a published pack". NIC creates no ArgoCD repository credentials for pack repos (pkg/argocd/secrets.go:54-58, docs/operations/argocd-project-scoping.md:22-24), so a private repo fails to sync until someone adds one.

Fix

• Change every Application example to project: nebari-apps and add managedNamespaceMetadata.labels: {nebari.dev/managed: "true"} next to CreateNamespace=true.
• Add an Application YAML to "Deploy via ArgoCD" in build-your-own.md (it is prose only today).
• Document the repository credential secret needed for private repos.

Not run on a live NIC cluster. To check the project rejection, apply the README Helm Application and read kubectl -n argocd get application my-pack -o jsonpath='{.status.conditions}'.

Verified against this repo at 4e50cd0, nebari-operator v0.1.1 (same commit as operator main), and NIC v0.14.0.