fleet-gitops: post-archive cleanup (repo stays archived, not deleted)

[lukeheath]

Follow-up to #40300. fleetdm/fleet-gitops is archived and will stay archived (we are not deleting it). References were removed from the monorepo and users redirected to fleetctl new in #50134 and fleetdm/fleet-gitops#131.

Because the repo stays archived forever, there is no deletion gate here. An archived repo stays public and cloneable read-only, so nothing breaks. The items below are cleanup/hygiene, in rough priority order.

Cleanup (primary)

• Retire the Render CI infrastructure. .github/workflows/render-deploy.yml references the fleet-gitops-ci-premium / fleet-gitops-ci-free / fleet-gitops-ci-mysql / fleet-gitops-ci-redis Render services that ran the fleet-gitops repo's own CI. An archived repo runs no CI, so these are now idle and can be torn down and their references removed. This is cost/hygiene and is the only item with near-term value. (Infra DRI: Robert Fairburn.)

Eventual (not urgent)

• Repoint the GitOps integration tests at the fleetctl new seed. cmd/fleetctl/integrationtest/gitops/gitops_integration_test.go and gitops_enterprise_integration_test.go clone the archived repo at test time. They keep passing today, but the repo is now frozen with deprecated keys (queries, team_settings); when a future fleetctl stops supporting (not just warning on) those keys, the tests break. Repointing them at the seed fleetctl new generates (cmd/fleetctl/fleetctl/templates/new/) both removes the dependency on a frozen/deprecated repo and gives the tests ongoing value: they'd validate the scaffold customers actually get today. Note the enterprise test iterates the old repo's teams/*.yml layout, so this is a rewrite, not a path swap.

Optional

• Add curl timeouts to both GitOps action copies, consistently. .github/actions/gitops/action.yml and the fleetctl new template action (cmd/fleetctl/fleetctl/templates/new/.github/fleet-gitops/action.template.yml) share an un-timed curl version check. Add --connect-timeout / --max-time to both. (Flagged by Copilot and CodeRabbit on Prepare to archive fleet-gitops repo #50134; deferred there to keep the dogfood decouple byte-faithful and avoid drift between the two copies.)

Separate archive pass

• gitops-workshop. fleetdm/gitops-workshop (named in Archive fleet-gitops and gitops-workshop repo #40300's title) is still un-archived. Archive it under the same never-delete policy: sweep references, then archive.

---

Dropped from the original plan: the external uses: fleetdm/fleet-gitops consumer sweep. That only mattered as a pre-deletion safety check; since we're keeping the repo archived rather than deleting it, remote consumers never break and no sweep is needed.