Upgrade ArgoCD v3.3.2 → v3.3.6, SHA-pin install manifest

Patch upgrade with bug fixes (diff normalization, installation ID cache).
Pin the upstream manifest URL to commit SHA for supply chain integrity.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

argocd/manifests/argocd/kustomization.yaml

@@ -5,7 +5,8 @@ namespace: argocd
 
 resources:
   # Pin to specific version for intentional upgrades
-  - https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.2/manifests/install.yaml
+  # ArgoCD v3.3.6
+  - https://raw.githubusercontent.com/argoproj/argo-cd/998fb59dc355653c0657908a6ea2f87136e022d1/manifests/install.yaml
   - ingress-tailscale.yaml
   - external-secret-repo-forge.yaml
   - external-secret-oidc-authentik.yaml

docs/changelog.d/+argocd-v3.3.6.infra.md

@@ -0,0 +1 @@
+Upgrade ArgoCD from v3.3.2 to v3.3.6 (bug-fix patches), SHA-pin install manifest

service-versions.yaml

@@ -141,8 +141,8 @@ services:
 
   - name: argocd
     type: argocd
-    last-reviewed: 2026-02-26
-    current-version: "v3.3.2"
+    last-reviewed: 2026-04-07
+    current-version: "v3.3.6"
     upstream-source: https://github.com/argoproj/argo-cd/releases
     notes: Kustomize-based install with ServerSideApply