## Why
ArgoCD SSO fails: `failed to query provider
".../application/o/argocd/": tls: failed to verify certificate: x509:
certificate signed by unknown authority`. argocd-server performs OIDC
discovery to identity.unkin.net over TLS served by the internal `unkin.net`
CA. Unlike argocd-repo-server (which mounts vault-ca-cert), argocd-server has
no internal CA in its trust store and no rootCA in oidc.config, so it has
never trusted the issuer — this is the first working DNS/cert for
identity.unkin.net, so OIDC egress was failing from the start.
## Change
- argocd-cm `oidc.config`: add `rootCA` (inline PEM) = the internal `unkin.net`
root. argocd-server hot-reloads argocd-cm, so no rollout is needed.
Anchoring on the long-lived root (not the intermediate) is deliberate: the
`unkin.net Intermediate Authority` was recently re-keyed (identity presents the
current intermediate in its handshake; the cluster `vault-ca-cert` bundle still
carries the stale one and does NOT validate the served cert). The root is
stable (valid to 2034) and matches the host trust anchor. Verified with
`openssl verify -CAfile <root> -untrusted <served-intermediate> <served-leaf>`.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
unkinben