Reconcile the Flux entrypoints instead of applying them by hand

Twenty-four Flux objects across eleven repos, none of them managed by
Flux. Each repo declares its own GitRepository and Kustomization, which
is the right ownership model, but nothing ever watched the directory
those files live in — so editing one in git changed nothing until
someone remembered to kubectl apply it. That cost real time twice this
week: the CONTROL_PLANE_REF_NAME rollout looked applied and was not, and
LLM_INPUT_COST failed the build with "variable not set" while sitting
correctly in git.

The gap is the bootstrap Kustomization that `flux bootstrap` would have
created and flux-operator does not. Add one per repo, watching that
repo's own ./dev, living in ./dev so it manages itself. Nothing moves
between repos; each domain keeps its entrypoints.

This is the first of eleven, starting with platform-llm because its cost
settings are blocked behind exactly this.

Needs one kubectl apply to exist. That is the last one this repo needs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

dev/bootstrap-kustomization.yaml

@@ -0,0 +1,31 @@
+# The missing link. Everything else in dev/ — the GitRepository, the two
+# Kustomizations, the three ExternalSecrets — was applied once by hand and then
+# never re-read, because no Kustomization watched this directory. Editing
+# proxy-kustomization.yaml in git changed nothing in the cluster until someone
+# remembered to kubectl apply it, which cost real time more than once (the
+# CONTROL_PLANE_REF_NAME rollout, then LLM_INPUT_COST).
+#
+# This object watches ./dev, so those files are reconciled like any other
+# manifest. It lives in ./dev itself, so it also manages itself — the same
+# self-referential arrangement `flux bootstrap` sets up.
+#
+# Apply it once with kubectl. That is the last manual apply this repo needs.
+#
+# Sharp edge worth knowing: with prune enabled, deleting proxy-kustomization.yaml
+# from git deletes the Kustomization it defines, and that Kustomization's own
+# prune then removes the Kong configuration it manages. That is GitOps behaving
+# correctly, but the blast radius of removing one file is two levels deep.
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: platform-llm-dev-bootstrap
+  namespace: llm
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: platform-llm-dev
+  path: ./dev
+  prune: true
+  # No postBuild here on purpose: the entrypoint manifests carry literal values,
+  # and the substitutions belong to the Kustomizations they define.