Add Argo CD CVE-2025-55190 environment - #780

The previous commit added `!argocd/` and `!base/argocd/` to .gitignore
to defeat a personal global '*' rule on the contributor's machine.
That workaround is local-environment-specific and shouldn't ship in the
repo; the argocd files are already tracked so removing the overrides
has no effect on tracking.

Inserts a screenshot of the Argo CD sign-in page as 1.png to anchor the
beginning of the UI walkthrough, shifting the existing Repositories list
and project Roles screenshots to 2.png and 3.png. Also shows the
admin-password command's sample output so readers know what the
auto-generated 16-character random string looks like.

The shipped manifest argocd-install-v2.14.15.yaml was 26165 lines, of
which 90% (23551 lines) was OpenAPI schema for Argo CD's three CRDs
(Application, ApplicationSet, AppProject). That bulk made the
contribution hard to review.

Drop the bundled file and have bootstrap.sh apply the manifest from
raw.githubusercontent.com/argoproj/argo-cd/v2.14.15/manifests/install.yaml
at first-container-start. Verified end-to-end: bootstrap completes in
~80 s and the CVE-2025-55190 reproduction still leaks the helm-repo
credentials through /api/v1/projects/myproject/detailed while the
proper /api/v1/repositories endpoint correctly returns an empty list
for the same low-privilege token.

A user with only `projects, get` is the CVE's minimum attacker
per GHSA-786q-9hcg-v9ff; centering the demo on it (instead of a
token read from /etc/) makes the privilege escalation land.

Cut from 3 repos to 2 (helm + git PAT), removed UI perspective 3
section, compressed Environment Setup, added language tags and
inline comments to the shell snippets, and trimmed surrounding
prose. Lab demo is unchanged.

1.png was 2.8 MB; resized to 1600 px wide and re-encoded to 470 KB
to match the size profile of the other two screenshots.