feat(spec): add AgenticApplication to data model spec (#1648)

## Summary

- Adds **AgenticApplication** to
`docs/internal/design/ambient-model.spec.md` — a GitOps continuous sync
resource (Argo CD for Ambient) that reconciles agent fleet definitions
from a git repository to a target Ambient instance
- Defines the full concept mapping from Argo CD (Source, Destination,
Sync Status, Health, Self-Heal, Prune) to Ambient equivalents
- Clarifies that **Cluster and Ambient are infrastructure inventory
(destinations), not sync targets** — AgenticApplication syncs Projects,
Agents, RoleBindings, and Inbox seeds only
- Adds ERD entity, field reference table, sync lifecycle, destination
resolution, multi-environment promotion examples
- Adds API endpoints (CRUD + `/sync`, `/refresh`, `/status`
sub-resources)
- Adds CLI commands (`acpctl get/create/sync/refresh
agentic-application`)
- Adds `gitops:admin` and `gitops:viewer` RBAC roles with permission
matrix column
- Adds 6 design decisions and 3 implementation coverage matrix rows

## Design Highlights

 < /dev/null |  Argo CD | Ambient |
|---|---|
| Application | AgenticApplication |
| Cluster + Namespace | Ambient instance + Project |
| Helm / Kustomize / Jsonnet | Kustomize only (built-in engine from
`acpctl apply -k`) |
| K8s API targeting | Ambient REST API targeting (SDK client, not
kubeconfig) |
| App of Apps | Multiple AgenticApplications per sector (s0→s5
promotion) |

## Test plan

- [ ] Spec review: verify ERD relationships render correctly in Mermaid
- [ ] Verify field descriptions are complete and unambiguous
- [ ] Validate RBAC matrix is consistent with existing roles
- [ ] Confirm API endpoint naming follows existing conventions
(`/api/ambient/v1/agentic_applications`)

🤖 Generated with [Claude Code](https://claude.ai/code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Added Application (GitOps) as a first-class entity with ER diagram and
fields for git source, destination, credentials, sync/prune/self-heal
flags, status, per-resource breakdowns, and audit timestamps.
* New "Application — GitOps Continuous Sync" section detailing kinds
synced, lifecycle (refresh/render/diff/sync/status), destination
resolution, pruning rules, and unsupported-kind handling.
* Extended API/CLI docs with CRUD plus /sync, /refresh, /status
endpoints and status examples.
* Added gitops:admin and gitops:viewer roles, updated permission matrix,
labels/annotations conventions, design notes, and implementation
coverage placeholders.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: user <u@example.com>
Co-authored-by: Claude <noreply@anthropic.com>

Author: 3 people