Bootstrap the cluster

Goal: seven Talos nodes running Kubernetes, with Argo CD syncing apps from the manifests branch. About 15 minutes.

Procedure

Create the VMs and bootstrap Talos. The stack writes core/talosconfig and core/kubeconfig.
Terminal window
```
just core talos up
```
Point your clients at the new cluster. The talos-* recipes read ~/.talos/config.
Terminal window
```
cp core/talosconfig ~/.talos/config
export KUBECONFIG="$PWD/core/kubeconfig"
```
Create the two bootstrap Secrets, openbao/openbao-unseal-key and cert-manager/cloudflare-api-token. Both carry Prune=false, so Argo CD never deletes them.
Terminal window
```
just create-secrets
```
Install Cilium, Gateway API and its IP pool, cert-manager and Argo CD. The ApplicationSet tracks manifests_branch from config.yml.
Terminal window
```
just core platform up
```

just talos-health
kubectl get nodes
kubectl get applications -n argocd

All seven nodes are Ready. Most applications show Degraded: they wait on OpenBao, which stays sealed until Phase 2.