Repo-server recovery forced a "normal" application refresh, which only
re-compares against the manifest cache — exactly what a just-restarted
repo-server has lost. Apps that were Unknown because manifest generation
failed stayed Unknown until the wait timed out. It also refreshed only the
one app that tripped the detector, though a repo-server outage stalls every
app that couldn't generate manifests.

Add hardRefreshApplications, which annotates each named Application with
argocd.argoproj.io/refresh: hard (reusing refreshHardPatch) to force a git
re-fetch past the cache. triggerRepoServerRecovery now delegates to it for
the trigger app, and the wait loop hard-refreshes every currently-Unknown app
after a successful restart.

Tests drive the fake dynamic client and assert the patch is hard, not normal;
empty names are skipped; a nil dynamic client is a safe no-op.

…ust the label

`app upgrade --sync` selected the root's children by the label
app.kubernetes.io/instance=argocd-apps only. ArgoCD's "annotation" and
"annotation+label" resource-tracking methods leave that label empty and
record ownership in the argocd.argoproj.io/tracking-id annotation instead —
the case the verification run hit, where the primary selector matched nothing
and the fallback synced EVERY Application in the namespace. On a shared
cluster that also touches third-party Applications the CLI does not own.

trackingOwner now reads both markers: the label wins when set, otherwise the
annotation's owner (the segment before the first ":", split rather than
prefix-matched so "argocd-apps-foo" is not mistaken for "argocd-apps"). The
"sync everything" fallback is kept, but only as a genuine last resort when
neither marker is present anywhere.

Tests: the pure trackingOwner selection (owner parsing, look-alike guard),
annotation-only selection excluding a foreign owner without hitting the
fallback, and the fallback preserved when nothing is tracked. Verified to
fail on the old label-only path (it synced the foreign app).

The ArgoCD install used a baseline embedded in the binary with no user lever:
openframe-helm-values.yaml reached only the app-of-apps chart, so a user could
not change an ArgoCD value (e.g. re-enable dex) without rebuilding the CLI.

Add a dedicated top-level `argocd:` section to that file, deep-merged over the
embedded baseline (maps merge, scalars/lists replace — Helm semantics) and fed
to helm via stdin. Only that subtree is used, never the whole file: the rest
targets the app-of-apps chart under a different (flat) schema and carries the
docker registry password, which must not leak into the argo-cd release. The CLI
warns and lists the overridden keys, since a bad override can break the install;
with no `argocd:` section the baseline is returned unchanged.

Verified with helm template that `argocd: {dex: {enabled: true}}` re-enables
dex-server while the baseline (developer account, RBAC) survives the merge.
Tests cover the no-op, re-enable, deep-merge/list-replace, and key-sorting
paths plus deepMerge directly. Documented in local-development.md and the
values.yaml header.

clean matched a broad `openframe-*` glob that also caught tracked files like
openframe-helm-values.example.yaml and deleted them; scope it to the
platform-suffixed binaries (openframe-{linux,darwin,windows}-*).

build-all claimed "all platforms" but built 3 of the 6 release targets,
missing linux/arm64, darwin/amd64, and windows/arm64 — so a cross-compile
break on those slipped past a pre-release `make build-all`. Build all six, to
match .goreleaser.yml.

test-integration's comment claimed it needs `make build`; the harness builds
its own binary (tests/integration/common/cli_runner.go), so correct it to the
real prerequisites (docker + k3d).

Add `all` to .PHONY. Extract the duplicated unit-test package list into
UNIT_PKGS. Auto-generate `help` from `## ` target comments so it can't drift.
Add fmt/vet/tidy targets so local gating matches CI (gofmt, go vet, go mod
tidy -diff). Add -trimpath to builds for reproducibility, matching the release.

….yml

GoReleaser's changelog is `use: github-native`, which delegates note
generation to GitHub's API and IGNORES GoReleaser's own groups/filters — so
the Features/Bug-fixes grouping and the docs/chore exclusions in .goreleaser.yml
never actually applied. With this repo's squash-merge and free-form PR titles
(0 of the last 30 commits match feat:/fix:, and the heavily-used `refactor:`
was in the exclude list), commit-title grouping would have dropped or misfiled
real changes anyway.

Add .github/release.yml so GitHub categorizes notes by PR LABEL — robust to
free-form titles — into Features (enhancement), Bug Fixes (bug), Documentation
(documentation), and a catch-all Other Changes, excluding automated/bot and
non-shipping PRs. Remove the now-dead groups/filters from .goreleaser.yml and
point a comment at the new file.

Effective next release; requires PRs to be labeled for categorization
(unlabeled PRs fall through to Other Changes, never silently dropped).

…on ref mismatch

Two wait-loop fixes plus a test gap, from review.

Stall handling chose the hint-vs-sync branch by whether the one-shot sync had
already fired (!stragglerSyncTriggered), not by mode. On the upgrade path
(SyncStragglersOnStall) that meant: fire the sync once, then on every later
stall tick fall through and print "they will not sync on their own — run
`openframe app upgrade --sync`" — advising the user to run the very path they
are already on. Select the branch by config.SyncStragglersOnStall so the hint
is confined to the non-sync (install) path. Capture time.Now() once for both
stall calls.

Ref-pinning validation stopped the spinner neutrally and then returned an
error, unlike the timeout path which Fails it. Decide the spinner's final state
from the outcome: Fail on a mismatch, neutral Stop on success.

Add a pending-rollback case to the friendly-hint test — the code already maps
it, the test didn't cover it.

…talled"

The prerequisites framework only knew IsSatisfied (a bool), so the renderer
printed "✗ <name> is not installed" for every unsatisfied item. Docker's
predicate is IsDockerRunning, so a Docker that is installed but whose daemon is
down was reported as "not installed" with "How to install" docs — both wrong;
the user needs to START it, not install it.

Add an optional Prerequisite.Detail that explains the specific reason when it
beats "not installed"; the runner carries it into MissingItem.Reason at every
missing-item site (including the installed-but-still-unsatisfied path, i.e. the
WSL-Alpine case where apk installs docker but no OpenRC starts the daemon). The
renderer shows the reason and drops the misleading install docs when the tool
is present; genuinely-absent tools are unchanged. Docker supplies the reason,
distinguishing a present binary (daemon down) from a truly absent one.

…g it

MergedArgoCDValues type-asserted userValues["argocd"] to a map and treated a
failed assertion the same as "key absent" — returning the baseline silently.
So a present-but-non-map override (a scalar, a list, or wrong indentation that
makes `argocd:` null with keys floating to the top level) was dropped with no
error and no warning, contradicting the "overrides are announced" UX and
matching the V3 silent-failure class.

Distinguish the cases: absent, bare `argocd:` (null), and `argocd: {}` stay a
no-op (baseline unchanged); a present non-map value returns a descriptive error
naming the key, which installArgoCDHelm surfaces so the install fails loudly.
Valid maps deep-merge as before.

Tests cover the malformed types (bool/string/list/number) erroring and the
null/empty no-op paths.