fix(arc): disable prune on arc-tf to break controller-vs-argocd loop

[xnoto]

Summary

The arc-tf Application is stuck in a Progressing/OutOfSync loop. Live state shows ArgoCD repeatedly trying to prune four resources:

• `ServiceAccount/arc-tf-gha-rs-no-permission` (orphan from before `serviceAccountName: arc-tf-runner` — the chart conditionally renders this only when `serviceAccountName` is unset)
• `AutoscalingListener/arc-tf-669cdf59-listener`
• `Role/arc-tf-669cdf59-listener`
• `RoleBinding/arc-tf-669cdf59-listener`

The listener triplet is created dynamically by the gha-runner-scale-set controller for each AutoscalingRunnerSet generation. The controller labels them with `app.kubernetes.io/instance: arc-tf`, so ArgoCD's default label-based tracking method claims them as managed. The chart does not render them, so with `prune: true` ArgoCD prunes them and the controller immediately recreates them.

Disable prune on this Application. selfHeal still reconciles chart-rendered resources; only the controller-owned dynamics stop being pruned.

Test plan

• After ArgoCD reconciles, `arc-tf` health = Healthy and the Progressing loop stops
• AutoscalingListener pod stays running across reconciles (logs show no churn)
• Manual cleanup of the orphan `arc-tf-gha-rs-no-permission` SA after merge: `kubectl -n arc-runners delete sa arc-tf-gha-rs-no-permission`

🤖 Generated with Claude Code