argocd: track resources by annotation

Drops the label tracking pin kept through the 3.x upgrades, so Argo CD uses its default argocd.argoproj.io/tracking-id annotation. Labels can be copied by other tools (cert-manager's ingress-shim copied app.kubernetes.io/instance onto Certificates); the annotation names the exact resource. Every app gets synced once right after, so resources removed later are still recognised for pruning.

argocd/overlays/argocd-cm.patch.yaml

@@ -7,10 +7,6 @@ metadata:
     app.kubernetes.io/part-of: argocd
 data:
   url: https://argocd.rubenhensen.nl
-  # Argo CD 3.0 defaults to annotation tracking. Stay on labels through the
-  # upgrade so no app loses track of its resources; switching is a
-  # separate step that needs every app synced once.
-  application.resourceTrackingMethod: label
   oidc.config: |
     name: Authentik
     issuer: https://authentik.rubenhensen.nl/application/o/argocd/