Argo CD $values multi-source ref is Git-only; blocks argocd deployer over OCI

[mchmarny]

Surfaced during live acceptance testing of #843 (PR #956). The raw argocd deployer's pkg/bundler/deployer/argocd/templates/application.yaml.tmpl renders child Applications with a multi-source pattern:

sources:
  - repoURL: {{ .Repository }}        # upstream Helm chart, e.g. https://charts.jetstack.io
    chart: {{ .Chart }}
    targetRevision: {{ .Version }}
    helm:
      valueFiles:
        - $values/{{ .BundleDir }}/values.yaml
  - repoURL: '{{ .RepoURL }}'         # AICR's repo — assumed Git
    targetRevision: {{ .TargetRevision }}
    ref: values

The ref: values source is consumed by Argo CD via $values/... substitution. Argo CD's $values multi-source support is Git-only — pkg/cli/bundle.go:172-176 now derives an oci://... repoURL for --deployer argocd --output oci://..., but Argo CD's repo-server then attempts a Git ListRefs against the OCI URL:

time=… level=error msg="Failed to get git client for repo oci://registry.aicr-registry.svc.cluster.local:5000/aicr/eks-training: failed to list refs: unsupported scheme \"oci\""

This is a known Argo CD design limitation, not a config bug. Two viable fixes for AICR:

Option A — Inline values in the template when target is OCI. application.yaml.tmpl would render helm.valuesObject: {{ .Values | toYaml | nindent N }} instead of helm.valueFiles: [$values/.../values.yaml]. Bundler already has the rendered values in hand; embedding them into the manifest is straightforward but produces larger Application manifests.

Option B — Drop multi-source; render a per-component values-blob in the Application's helm.values: |- string. Same goal, marginally different shape.

Option C — Push the bundle to a Git source for the argocd deployer; reserve OCI for argocd-helm (where the whole chart is the artifact and $values is not used). Documented constraint, less impactful change.

Phase-0 spike for #843 missed this because the spike used a hand-rolled minimal Application shape (source.directory.recurse) without the multi-source $values indirection. The live acceptance test on eks-training (14 child Applications, mix of upstream + local Helm) caught it.

PR #956 (currently draft) ships the helm + argocd-helm-oci lanes; argocd-oci is on hold pending this issue. See PR description for the full state.