Remove nessus app and fix envoy-gateway OCI chart bug

- Delete nessus Application CRD, manifests, and bootstrap script
- Vendor envoy-gateway Helm chart (v1.6.3) locally to work around
  ArgoCD v3.3.3 Docker Hub OCI resolution bug
- Re-enable auto-sync for envoy-gateway

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

charts/envoy-gateway/templates/certgen.yaml

@@ -0,0 +1,79 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "eg.fullname" . }}-certgen
+  namespace: '{{ .Release.Namespace }}'
+  labels:
+  {{- include "eg.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": pre-install, pre-upgrade
+  {{- if .Values.certgen.job.annotations }}
+    {{- toYaml .Values.certgen.job.annotations | nindent 4 -}}
+  {{- end }}
+spec:
+  backoffLimit: 1
+  completions: 1
+  parallelism: 1
+  template:
+    metadata:
+      labels:
+        app: certgen
+        {{- if .Values.certgen.job.pod.labels }}
+          {{- toYaml .Values.certgen.job.pod.labels | nindent 8 -}}
+        {{- end }}
+      {{- if .Values.certgen.job.pod.annotations }}
+      annotations:
+        {{- toYaml .Values.certgen.job.pod.annotations | nindent 8 -}}
+      {{- end }}
+    spec:
+      containers:
+      {{- $args := .Values.certgen.job.args }}
+      {{- if not .Values.topologyInjector.enabled }}
+        {{- $args = append $args "--disable-topology-injector" }}
+      {{- end }}
+      {{- if $args }}
+      - args:
+        {{- toYaml $args | nindent 8 }}
+        command:
+        - envoy-gateway
+        - certgen
+      {{- else }}
+      - command:
+        - envoy-gateway
+        - certgen
+      {{- end }}
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: KUBERNETES_CLUSTER_DOMAIN
+          value: {{ .Values.kubernetesClusterDomain }}
+        image: {{ include "eg.image" . }}
+        imagePullPolicy: {{ include "eg.image.pullPolicy" . }}
+        name: envoy-gateway-certgen
+        {{- with .Values.certgen.job.resources }}
+        resources:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
+        securityContext:
+          {{- toYaml .Values.certgen.job.securityContext | nindent 10 }}
+      {{- include "eg.image.pullSecrets" . | nindent 6 }}
+      {{- with .Values.certgen.job.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.certgen.job.nodeSelector }}
+      nodeSelector:
+        {{ toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.certgen.job.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
+      restartPolicy: Never
+      serviceAccountName: {{ include "eg.fullname" . }}-certgen
+  {{- if not ( kindIs "invalid" .Values.certgen.job.ttlSecondsAfterFinished) }}
+  ttlSecondsAfterFinished: {{ .Values.certgen.job.ttlSecondsAfterFinished }}
+  {{- end }}