[codex] CES-108: ensure registry overlay hooks run

[cesaregarza]

Summary

• Remove ApplyOutOfSyncOnly=true from the hook-bearing registry overlay Argo Application so PostSync hooks execute.
• Add a regression test that pins the PostSync restart hook and prevents selective sync on the registry overlay app.
• Document the Argo selective-sync hook failure mode in the registry overlay README.

Root cause

Argo CD selective syncs skip hooks. With ApplyOutOfSyncOnly=true, prod could apply the overlay ServiceAccount/ConfigMap/RBAC resources while never creating the PostSync restart Job, leaving the control plane serving the previous boot-cached registry snapshot.

Validation

• env UV_CACHE_DIR=/root/dev/.uv-cache uv run --directory /root/dev/SplatTopConfig-ces108-hook-reliability python -m unittest tests.test_agent_control_plane_registry_overlay
• env UV_CACHE_DIR=/root/dev/.uv-cache uv run --directory /root/dev/SplatTopConfig-ces108-hook-reliability python -m unittest discover -s tests
• git -C /root/dev/SplatTopConfig-ces108-hook-reliability diff --check