fix: Add Replace=true sync option to Jobs for ArgoCD compatibility

Jobs are immutable in Kubernetes. Without Replace=true, ArgoCD fails
to sync when it tries to update an existing Job. This annotation tells
ArgoCD to delete and recreate the Job instead.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

prototypes/forgejo/ytt/admin-secret-job.ytt.yaml

@@ -41,6 +41,8 @@ kind: Job
 metadata:
   name: forgejo-admin-secret-init
   namespace: #@ ns
+  annotations:
+    argocd.argoproj.io/sync-options: Replace=true
 spec:
   ttlSecondsAfterFinished: 300
   template:

prototypes/forgejo/ytt/argocd-deploy-key-job.ytt.yaml

@@ -39,6 +39,8 @@ kind: Job
 metadata:
   name: argocd-deploy-key-init
   namespace: #@ ns
+  annotations:
+    argocd.argoproj.io/sync-options: Replace=true
 spec:
   ttlSecondsAfterFinished: 300
   template:

rendered/envs/production/forgejo/job-argocd-deploy-key-init.yaml

@@ -3,6 +3,7 @@ kind: Job
 metadata:
   annotations:
     a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
+    argocd.argoproj.io/sync-options: Replace=true
   name: argocd-deploy-key-init
   namespace: forgejo
 spec:

rendered/envs/production/forgejo/job-forgejo-admin-secret-init.yaml

@@ -3,6 +3,7 @@ kind: Job
 metadata:
   annotations:
     a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
+    argocd.argoproj.io/sync-options: Replace=true
   name: forgejo-admin-secret-init
   namespace: forgejo
 spec: