fix: clean up utcnow deprecation warnings, fix 12 failing tests, add CI/CD pipeline manifests

- Replace all datetime.utcnow() with datetime.now(tz=timezone.utc) across 8 files
- Fix 12 failing tests to match current implementation behavior
- Fix pytest_plugins in non-top-level conftest (moved to root conftest.py)
- Auto-fix 189 lint issues (import sorting, unused imports)
- Add CI/CD pipeline infrastructure (ARC, ArgoCD, Kargo manifests)
- Add values-beta.yaml and values-paper.yaml for staged deployments
- Update GitHub Actions workflow to use self-hosted-gremlin runners
- Add integration-test job to CI pipeline

Result: 1596 passed, 0 failed, 0 warnings

pipelines/argocd/apps/stonks-beta.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: stonks-beta
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/celesrenata/stonks-oracle.git
+    targetRevision: main
+    path: infra/helm/stonks-oracle
+    helm:
+      valueFiles:
+        - values-beta.yaml
+      parameters:
+        - name: image.tag
+          value: latest
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: stonks-beta
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true

pipelines/argocd/apps/stonks-live.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: stonks-live
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/celesrenata/stonks-oracle.git
+    targetRevision: main
+    path: infra/helm/stonks-oracle
+    helm:
+      valueFiles:
+        - values.yaml
+      parameters:
+        - name: image.tag
+          value: latest
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: stonks-oracle
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true

pipelines/argocd/apps/stonks-paper.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: stonks-paper
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/celesrenata/stonks-oracle.git
+    targetRevision: main
+    path: infra/helm/stonks-oracle
+    helm:
+      valueFiles:
+        - values-paper.yaml
+      parameters:
+        - name: image.tag
+          value: latest
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: stonks-paper
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true

pipelines/argocd/repo-secret.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: stonks-oracle-repo
+  namespace: argocd
+  labels:
+    argocd.argoproj.io/secret-type: repository
+type: Opaque
+stringData:
+  url: https://github.com/celesrenata/stonks-oracle.git
+  type: git
+  password: PLACEHOLDER  # Filled at deploy time from gremlin-1's github_token

pipelines/argocd/values.yaml

@@ -0,0 +1,27 @@
+# Helm values for ArgoCD
+# Chart: argo/argo-cd
+# Namespace: argocd
+
+# Disable dex (not needed)
+dex:
+  enabled: false
+
+# ArgoCD server configuration
+server:
+  # Expose via Traefik ingress with TLS
+  ingress:
+    enabled: true
+    ingressClassName: traefik
+    hostname: stonks-argocd.celestium.life
+    annotations:
+      cert-manager.io/cluster-issuer: ca-issuer
+    tls: true
+
+  # Run server in insecure mode behind TLS-terminating ingress
+  extraArgs:
+    - --insecure
+
+# Tell the chart to use HTTP backend port for ingress
+configs:
+  params:
+    server.insecure: true