fix: execute prepared Gitea legacy cleanup

config/platform-infra/gitea.yaml

@@ -703,7 +703,7 @@ app:
         upstream: http://gitea-http.devops-infra.svc.cluster.local:3000
     legacyCleanup:
       enabled: true
-      execute: false
+      execute: true
       jobName: gitea-legacy-public-exposure-cleanup
       serviceAccountName: gitea-legacy-public-exposure-cleanup
       image: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1

scripts/src/platform-infra-gitea-gitops-delivery.test.ts

@@ -86,7 +86,11 @@ test("owning YAML renders one child Application and the complete durable bridge
   expect(resource("ServiceAccount", "gitea-legacy-public-exposure-cleanup")).toBeDefined();
   expect(resource("Role", "gitea-legacy-public-exposure-cleanup")).toBeDefined();
   expect(resource("RoleBinding", "gitea-legacy-public-exposure-cleanup")).toBeDefined();
-  expect(resource("Job", "gitea-legacy-public-exposure-cleanup")).toBeUndefined();
+  const cleanupJob = resource("Job", "gitea-legacy-public-exposure-cleanup");
+  expect(cleanupJob).toBeDefined();
+  expect(cleanupJob.metadata.annotations["argocd.argoproj.io/hook"]).toBe("PreSync");
+  expect(cleanupJob.spec.template.spec.containers[0].args).toContain("deployment/gitea-frpc");
+  expect(cleanupJob.spec.template.spec.containers[0].args).toContain("secret/gitea-frpc-secrets");
   const pacReadOnlyNamespaces = documents
     .filter((item) => item.kind === "Role" && item.metadata?.name === "unidesk-pac-consumer-runner")
     .map((item) => item.metadata.namespace)